You prove a log was not edited with two layers: cryptographic digests that reveal any change or deletion after delivery, and write-once storage that blocks changes in the first place. In AWS, CloudTrail log file integrity validation provides the first, and S3 Object Lock provides the second.
Layer one: tamper evidence
AWS documents CloudTrail log file integrity validation as a way to determine whether a log file was modified, deleted or unchanged after delivery. It uses SHA-256 for hashing and SHA-256 with RSA for signing. When enabled, CloudTrail creates a hash for each log file it delivers. Every hour it also delivers a digest file that references the last hour of log files and contains a hash of each, signed with a private key. Each digest also carries the signature of the previous one, which forms a chain.
Two practical points follow from the documentation:
- Enabling validation only makes CloudTrail deliver the digests. It does not check anything. You must run the validation, for example with the AWS CLI, and keep the results.
- Digest files go to a separate folder in the same bucket, so you can apply tighter permissions to them than to the logs.
The validation can also help show that no log files were delivered during a given period, which is useful when an auditor asks about a quiet window.
Layer two: tamper resistance
Digests tell you after the fact. Object Lock tries to prevent the edit. AWS describes it as a write-once-read-many model that can prevent objects from being deleted or overwritten for a fixed time or indefinitely. It works only in buckets with versioning enabled.
| Option | Effect | Use for audit evidence |
|---|---|---|
| Compliance mode | No user, including the account root user, can delete or overwrite a locked version during retention | Final evidence that must not change |
| Governance mode | Most users blocked, privileged users can bypass with special permission | Testing, or evidence you may need to correct |
| Legal hold | Same protection, no end date, removed explicitly | Keeping evidence until an audit or investigation closes |
AWS suggests a legal hold when you have an upcoming external audit and want objects immutable until it completes. Note that locks protect specific object versions. New versions can still be written to the same key, so name evidence files with dates.
Putting it together
- Turn on CloudTrail log file integrity validation for every trail.
- Deliver logs to a bucket with versioning and Object Lock, with a retention period at least as long as your audit window plus margin.
- Run validation on a schedule, for example weekly, and store the output with a date.
- Restrict who can change retention settings, and alert on any attempt to do so.
- Document all of this in a control narrative, including who reviews the validation results.
What this does not prove
Validation shows that files are unchanged since delivery. It does not show that the right events were logged. If a service is not covered by your trail, no digest helps. Check which regions, accounts and event types are in scope.
Quick check
Does enabling integrity validation validate my logs?
No. It produces digest files. You still have to run validation and keep the results.
Which Object Lock mode should evidence use?
Compliance mode if nothing must ever change during retention. Governance mode if you need the flexibility to correct mistakes with controlled permissions. Test governance first.
Is a hash the same as an immutable log?
No. A hash detects change. Immutability prevents it. Strong evidence uses both.
Safeguard includes compliance and evidence automation for collecting and organizing records like these. You can run a free scan to see what it finds.
Sources
Last reviewed: 19 October 2026.
