SigilbaseAWS audit logs, sealed as they arrive.
Sigilbase will collect audit logs, log files and configuration snapshots from AWS into a chained, signed ledger: every collection receipted, every gap declared, and evidence your auditor verifies offline without an account.
Named connectors ship in waves, and AWS is in the first. Until then, anything that can send JSON reaches Sigilbase through the events API today.
- Status. First wave.
- Collected by. A connector Sigilbase runs.
- Connects with. Cross-account role + external ID; CloudFormation StackSet one-click for org-wide.
- Category. Cloud infrastructure.
What can be ingested from AWS
Each stream below becomes its own sequence in the ledger, with the record kept exactly as AWS gives it and a hash of those bytes beside it. Snapshots are read on a cadence and the differences between them dated.
-
Event stream
CloudTrail management events (org trail preferred).
-
Log files
CloudTrail S3 delivery + digest files.
-
Event stream
CloudTrail data events (opt-in, filtered).
-
Snapshot
IAM users/roles/policies, IAM credential report, account password policy, S3 bucket encryption/public-access settings, KMS key rotation status, Organizations accounts/SCPs.
-
Event stream
AWS Config configuration items.
-
Event stream
GuardDuty findings.
-
Event stream
Security Hub findings.
-
Log files
VPC Flow Logs, ALB/CloudFront access logs (opt-in, volume-metered).
How it will be collected
When its connector ships, a connector Sigilbase runs will read AWS on a schedule you set.
AWS keeps this log for a limited time. The connector will collect continuously rather than on request, and warn you while a declared gap can still be backfilled from the source.
Stream and credential names follow the vendor's documentation as read in October 2026; the connector's build confirms them.
The evidence model
What every connector and receiver ships with, whatever the source:
- A receipt per collection: what was asked for, what arrived, the cursor before and after
- A declared gap for any interval nothing covers, never a blank
- A daily settlement once late records can no longer arrive
- The raw record, byte for byte, with its hash
- An evidence bundle anyone can verify offline
What you get
-
Sealed as it arrives
Every record is hashed and chained to the one before; every few minutes the chain is sealed into a signed checkpoint. A changed, deleted or reordered record fails verification at that exact point.
-
Continuity you can show
The receipts chain too, so an auditor sees not only the records but that nothing between them went uncollected, and where a gap was, that it was declared.
-
Verified without us
An export carries the open-source verifier. It runs offline, checks the chain, the receipts and the gaps, and needs no Sigilbase account. How the service is run.
Questions about AWS
-
Does Sigilbase support AWS?
Named connectors ship in waves, and AWS is in the first. Until then, anything that can send JSON reaches Sigilbase through the events API today. Whatever arrives is written to a chained, signed ledger whose evidence anyone can verify offline with the open-source verifier, without a Sigilbase account.
-
What AWS data can Sigilbase ingest?
Event stream: CloudTrail management events (org trail preferred). Log files: CloudTrail S3 delivery + digest files. Event stream: CloudTrail data events (opt-in, filtered). Snapshot: IAM users/roles/policies, IAM credential report, account password policy, S3 bucket encryption/public-access settings, KMS key rotation status, Organizations accounts/SCPs. Event stream: AWS Config configuration items. Event stream: GuardDuty findings. Event stream: Security Hub findings. Log files: VPC Flow Logs, ALB/CloudFront access logs (opt-in, volume-metered).
-
How will AWS evidence be collected and verified?
When its connector ships, a connector Sigilbase runs will read AWS on a schedule you set. Every collection will be receipted in the connection's own stream: what was asked for, what arrived, and the cursor before and after. An interval nothing covers will be declared as a gap, never left blank. Exports carry the standalone verifier, which checks the chain, the receipts and the gaps offline.
-
How long does AWS keep this log?
A limited time, which is why the connector will collect continuously rather than on request, and warn you while a declared gap can still be backfilled from the source.
Start recording provable history
Chained, sealed, independently verifiable audit logs, from the first event. Free while Sigilbase is in beta.
Questions first? Write to hello@sigilbase.io.