Amazon Web Services: follow the evidence.

01

Accountability

Role map

Roles depend on who decides purpose and means, who acts on instructions, and what each party actually does. Record the conclusion and its evidence; do not infer it from the vendor label.

• Name workload, platform, security, account and data owners.
• Separate organisation, account, role, service and support access.
• Record AWS and other managed-service roles from current agreements and architecture.

02

Collection surfaces

Collection and notice touchpoints

Walk each entry path as a real user. Save the notice, fields, choices, time and destination rather than relying on a policy page alone.

• Application APIs, databases, object storage, queues and logs.
• Developer access, support cases, observability and data pipelines.
• Backups, snapshots, replication, analytics and cross-account sharing.

03

Purpose discipline

Purpose and data minimisation checks

Every field and copy should have a named operating reason, accountable owner and review event.

• Map data classes to only required services, fields, logs and regions.
• Avoid personal data in resource names, tags and verbose logs.
• Limit non-production copies and broad data-lake ingestion.

04

Choice evidence

Consent and preference evidence

When consent is relied on, preserve the affirmative action and withdrawal path. Where another legal route is assessed, record that analysis instead of manufacturing a consent record.

• Carry collection and purpose evidence from the application layer.
• Do not treat an IAM permission as a data principal’s consent.
• Ensure downstream analytics uses match the recorded purpose.

05

Least privilege

Access control and privileged roles

Test ordinary view, sensitive fields, bulk action, export, configuration and integration access separately.

• Review root use, IAM Identity Center, roles, policies, keys and cross-account trust.
• Separate control-plane and data-plane access.
• Exercise key rotation, session revocation and departure.

06

Lifecycle

Retention, deletion, backup and export behaviour

A delete button is not a lifecycle rule. Record the start event, end event, exception, system action, residual copy and accountable approver.

• Define deletion for live stores, versions, replicas, caches, snapshots and backups.
• Test restore paths so deleted data is not silently reintroduced.
• Record region, archive and retention configuration by service.

07

Service chain

Processor, sub-processor and contract checks

Use the current contract and actual architecture. A product page cannot establish the complete role allocation for your organisation.

• Retrieve current AWS terms, DPA, service terms and sub-processor information.
• Inventory managed services, SaaS tools, support access and cross-account parties.
• Record exit, deletion, incident and assistance expectations.

08

Detection + response

Logs, monitoring and breach evidence

Coverage, event types, retention and exportability vary. Preserve an evidence timeline without claiming that one log proves the complete event.

• Confirm CloudTrail event coverage, trails or event stores, region scope and retention.
• Include data events where the risk and service require them.
• Protect logs and connect detections to the investigation workflow.

09

Request workflow

Rights-request search, export, correction and erasure workflow

1. 01

   Translate a verified person identifier into application and storage keys.

2. 02

   Search live services and owned data pipelines.

3. 03

   Apply exceptions and execute application-controlled correction or deletion.

4. 04

   Track versions, replicas, snapshots, backups and downstream confirmations.

10

Bounded configuration

Configuration checklist

No menu-path fiction: open the current vendor documentation and your live console together. Feature names, paths and entitlements can change.

11

Retrievable proof

Evidence to save

Save redacted configuration evidence in an approved internal location. This private preview does not accept uploads or store these records.

12

Do not overclaim

Known limitations and questions for the vendor