This morning’s SOC 2 evidence walkthrough went sideways when the ‘serverless’ team spun up 19 EC2 bastions to scrape logs for ‘ephemeral proof’. For audit assurance: evidence must be durable, timestamped, and independently reproducible; CloudTrail or it didn’t happen.
Got burned on this once — now we ship all control evidence from CloudTrail to an S3 “evidence” bucket with Object Lock and run reproducible Athena queries; “CloudTrail or it didn’t happen.” If someone insists on ad-hoc scraping, we require SSM session recording + KMS-signed outputs and push them to the same bucket (docs: Locking objects with Object Lock - Amazon Simple Storage Service) — otherwise it’s just serverless cosplay.
And we fixed ‘ephemeral proof’ by mirroring CloudTrail to a dedicated audit account via EventBridge; cheaper than 19 bastions, watch egress.