AWS Evidence
Evidence collector
A script that reads one class of configuration from an account, records what happened to it, and degrades to a reported failure rather than a silent gap.
What it is
One of five scripts that read a defined class of evidence from an account: account metadata, Security Hub posture, cost telemetry, resilience posture, or control checks.
Why each runs independently
An assessment that aborts when one collector fails produces nothing. An assessment that continues, and records what failed, produces a partial result that says so.
How GovIntel applies it
Each collector runs on its own, and every outcome is written to the evidence manifest whatever the result. Exception handling is specific rather than blanket, so a permission error is recorded as a permission error rather than hidden behind a clean-looking file.
Every AWS call a collector makes is listed in a machine-checkable manifest, and a test fails if the role grants something no collector calls or a collector calls something the role does not grant.
What it does not mean
A collector that succeeded does not mean its domain was scored. Collecting evidence and having enough of it to rate a domain are different things.