Collecting Audit Evidence from Bastion-Only Environments

The no-direct-access constraint

In a Bastion-only environment, the control plane is reachable, but production workloads are not. There are no inbound agents, no shared file system and often no outbound internet. The evidence you need — configuration, access, patch state, logs — lives inside the boundary.

The constraint is deliberate. Any collection design that weakens it defeats the purpose. The collector has to work within the same path operators use.

Why screenshots fail

A screenshot proves someone looked. It does not prove the control operated continuously or that the evidence is complete.

• They are not attributable to a specific collector or run.
• They cannot be reproduced or compared across periods.
• They go stale the moment the screen changes.
• They are easy to challenge in an audit.
• They do not scale beyond a handful of controls.

A collector architecture for restricted environments

This keeps the boundary intact while producing evidence that is machine-readable and comparable over time.

• Run a scheduled job inside the boundary, using the same access path as operators.
• Collect only the controls in scope, with explicit queries rather than broad scraping.
• Sign and hash the output at the point of collection.
• Deliver outbound only, to a controlled endpoint, with no inbound listener.
• Store the evidence with run metadata: collector version, scope, time and operator.

What to collect and how to map it to controls

Start from the control framework, not the available data. For each control, define the question, the source system and the query that answers it.

• Access: who can reach the environment, through which path, with which privileges.
• Configuration: security-relevant settings and drift from baseline.
• Patch state: applied versions and outstanding exceptions.
• Logging: whether audit logs are enabled, shipped and retained.
• Change: what changed in the period and who approved it.

Chain of custody

Evidence is only useful if you can show it was not altered. Hash each artifact at collection, sign the manifest, and record the time and collector identity. Store the hash separately from the artifact so a later comparison can detect tampering.

Access to the evidence store should be role-restricted and itself logged. The auditor should be able to verify integrity without access to the production environment.

Operating the collector

A collector is a system, not a script. It needs an owner, a schedule, a failure path and an exception process.

The goal is continuous, attributable evidence — not a scramble before the audit. The same principle applies to access recertification.

• Alert when a run fails or returns incomplete scope.
• Compare each run to the previous one and flag drift.
• Record exceptions with an owner and an expiry date.
• Review the control mapping when the framework or environment changes.