AWS Evidence
Evidence retention
How long each artefact survives, and why the raw evidence expires fastest while the fingerprinted snapshot can defensibly be kept longest.
The windows
| Artefact | Default |
|---|---|
| Raw evidence | 1 day |
| Board pack in the workflow | 7 days |
| Assessment snapshot | 90 days |
Why the raw evidence expires fastest
It is the most sensitive artefact and the one nobody needs after the assessment. It carries resource identifiers, control results and cost telemetry. It is internal only and is never delivered.
Why the snapshot can be kept longest
It carries no customer identifiers: control identifiers are the scanner's, resource identity is fingerprinted, and the account identifier is fingerprinted too. It names no resource and no account.
Why the deliverable and the evidence are separated at all
They are uploaded as separate artefacts so that delivering a pack cannot leak the evidence set, even by mistake. The delivery path can only ever resolve the pack.
What it does not mean
The snapshot window is also the comparison window. A reassessment beyond it finds no predecessor and correctly renders as a first assessment.