Export Audit Evidence
Audit records are technical evidence, not certification or a complete organizational trail. Audit consumes Redis, writes append-only Postgres rows, checks tamper state, and can export complete hourly Parquet partitions.
Prerequisites
Section titled “Prerequisites”Define evidence scope, retention, access, encryption, legal hold, and archive ownership. Configure AUDIT_EXPORT_S3_* only when needed and size AUDIT_EXPORT_TMP_DIR for the largest hourly partition.
Procedure
Section titled “Procedure”- Verify Audit readiness, HMAC, stream group, DLQ, and tamper metrics.
- Configure an operator-owned S3-compatible endpoint and least-privilege credentials.
- Enable export; monitor watermark, scratch space, upload failures, and objects.
- Correlate a canary request across producer, stream, Postgres, and export.
- Retain applicable HMAC material with verification evidence.
The watermark advances only after successful upload.
Verify and Recover
Section titled “Verify and Recover”Compare counts for a closed interval, inspect DLQ/lag, and verify intended reader access. On failure preserve Postgres, pending entries, DLQ, replay, scratch output, and logs before replay or deletion.
Next Step
Section titled “Next Step”Generate an Generate an Evidence Pack or complete Hand Off to Platform Teams.