By the end of this chapter, you will be able to:
Evidence is the currency that allows Architecture as Code to demonstrate trustworthiness at scale. Treating evidence as code means the artefacts that prove compliance are generated automatically, stored alongside the controls they verify, and versioned so that their provenance is unquestionable. Combined with the assure once, comply many principle, evidence captured for a single control objective can be replayed across multiple regulatory frameworks without repeating manual audits.
Evidence as Code systems collect machine-readable outputs—policy evaluation reports, Terraform plans, cloud configuration snapshots, build logs—directly from delivery pipelines. Artefacts are stored in immutable storage with cryptographic signing and metadata that references the originating control, environment, and timestamp. By keeping these artefacts in the same repositories as policies and blueprints, teams create a living catalogue that auditors can browse without requesting ad hoc exports.
Primary topics explored
- Learning Objectives
- Machine-collected, versioned artefacts
- Pipeline example: exporting MFA evidence
- Software Bill of Materials as Evidence
- Attestation Frameworks and Tamper-Evident Artefacts
- Evidence Lifecycle Management
About Architecture as Code
Infrastructure as Code represents a fundamental change in how we manage and develop IT infrastructure. This book provides organisations with practical guidance for implementing IaC principles whilst fulfilling local compliance requirements and optimising costs.
The book covers everything from fundamental principles and tools to advanced implementation strategies, security aspects, and organisational changes required for successful IaC adoption.
IT architects, DevOps teams, developers, and decision-makers within organisations.
Gunnar Nordqvist
Conceived, directed and published the books of The Transformed Architecture.
Continue with the full chapter
Chapter 15A: Evidence as Code and Continuous Assurance in Architecture as Code gives the detailed explanations, practical examples and implementation patterns behind this summary.
This whitepaper belongs to “Delivery and Operations” and is one of 38 drawn from the manuscript.