The ALCOA+ Field Guide for Platform Engineers
- Shameem Abdul Salam
- Aws , Dev ops
- September 10, 2026
Table of Contents
The auditor asked a simple question: “How do you know this file was not modified after upload?” The team had versioning off, a shared transfer credential, and a fourteen-second silence that felt much longer.
Most ALCOA+ writing is aimed at quality and regulatory people. This post is the engineering translation—a control mapping you can hand to a teammate before the next audit or design review. It assumes you already went live with a hybrid lab-to-cloud path. This is not legal or regulatory advice; validate the mapping with your quality team.
The one-table version
| Principle | Plain meaning | Primary AWS controls |
|---|---|---|
| Attributable | You can say who/what touched data and when | CloudTrail (management + data events), one IAM identity per agent |
| Legible | Readable by humans and systems for the retention period | Open/structured formats, schema registry, format migration plan |
| Contemporaneous | Recorded at the time of the action, not reconstructed | Source-side timestamps, NTP discipline, ingest-time vs event-time kept distinct |
| Original | The first capture is preserved, including copies | S3 versioning, Object Lock on raw, source checksums |
| Accurate | Data is what it claims to be | Checksum verification gates, quarantine on mismatch |
| Complete | Nothing missing, including context | Manifests, completion markers, metadata sidecars |
| Consistent | Same facts everywhere, in order | Correlation ids (run_id), idempotent consumers, ordered state transitions |
| Enduring | Survives time, failure, and platform change | Cross-region replication, KMS, documented retention, restore drills |
| Available | Retrievable on demand by the right people | Lifecycle tiering without deletion, access model, retrieval SLOs |
Attributable: identity all the way down
- CloudTrail data events for S3 are on for the data buckets—management events alone do not show object-level access.
- Every agent, validator, and consumer has its own role (separate identities by job)—“shared upload user” fails attribution by construction.
- Log lines carry
run_id,instrument_id,agent_id—an auditor should not need to infer identity from an IP address. - Break-glass use is time-bound, alarmed, and reviewed.
Original + Accurate: immutability with proof
- S3 versioning is on everywhere; a mistaken overwrite is a new version, not data loss.
-
raw/prefix has Object Lock (governance mode is usually enough; compliance mode is a one-way door—decide deliberately). - Source checksums are computed at capture, stored in metadata and sidecar, and verified before any marker is written (the transfer checklist).
- Checksum mismatch routes to quarantine with a reason, never a silent overwrite.
Contemporaneous + Consistent: timestamps and correlation
- Agent hosts sync time (NTP); clock skew is a documented risk, and event-time is recorded separately from ingest-time.
- One
run_idfrom instrument through validation to consumer—the correlation discipline is also a data-integrity control. - Consumers are idempotent on
run_id, so a redelivery cannot create two conflicting “truths.”
Complete + Enduring + Available: the retention shape
- A run is complete only with a manifest or marker—“the folder looked full” is not completeness.
- Retention for
raw/,validated/,quarantine/is written down, enforced by lifecycle policy, and matches what quality promised the auditor. - Cross-region replication or an equivalent endurance story exists for the data that matters.
- Tiering to colder storage never means deletion; retrieval paths are exercised on a calendar, not assumed.
Audit-day evidence pack
What to be able to produce in an hour, not a week:
- For any
run_id: who/what wrote each object (CloudTrail), checksum chain, marker time. - The retention policy as enforced (lifecycle + Object Lock config), not as described.
- Access history for a named principal over a period.
- Proof of a restore or replay performed under control.
If you only do one thing: turn on CloudTrail data events + S3 versioning + Object Lock on raw today—those three cheap defaults are the difference between answering audit questions from evidence and answering them from memory.
Next in this series: choosing between a poller, DataSync, and S3 Events for instrument ingestion.