Export an evidence package

An evidence package is a point-in-time capture of what a deployment’s resources actually look like in AWS, tied to the framework requirements they demonstrate. It generates automatically when a deployment applies, and you can re-capture it on demand.

The package states what the infrastructure demonstrates, with citations. It does not assert a compliance status for StackTakt or for any customer, and the PDF says so on its first page.

How capture works

After a successful apply, StackTakt assumes the read-only discovery role and reads back the configuration of every resource the deployment created: one named AWS call per capture, for example s3:GetEncryptionConfiguration or transfer:DescribeServer. Each captured item records the call, the resource, the timestamp, and the HIPAA Security Rule citations it demonstrates.

A package is Complete when every planned capture succeeded. If any read fails, the package is Incomplete and names exactly which resources are missing and why, rather than pretending. Re-capture evidence retries every read against the live account and writes a fresh package; packages are never edited in place.

The evidence page

Open an applied deployment and select View evidence. The page lists every item with its captured configuration, citation chips, and status. Two actions:

• Download PDF: the auditor-facing export.
• Re-capture evidence: a fresh capture of the live account.

What the PDF contains

1. The capability statement: what this package is and is not.
2. Deployment: organization, tenant, AWS account and region, template and version, who approved, when it applied, package status, and any missing captures.
3. Control coverage: the control mapping snapshotted at apply time, per control: citation, status, implementing resources, and every caveat printed verbatim.
4. Captured resource configurations: each item’s source call, resource, citations, and configuration. Items stored in the customer evidence store render a sha-256 content hash and size instead of inline data.
5. Audit trail: every audit event in the deployment’s thread, by correlation ID.

Why you can trust it

• The control coverage section comes from the snapshot taken at apply time, not from a mapping that may have changed since.
• Each captured payload is hashed (sha-256 over a canonical form), so a payload can be verified byte for byte later.
• The audit trail is append-only. Nothing updates or deletes an audit event, so the package’s history section cannot be quietly rewritten.