Attestations
An attestation is a signed statement of fact about a single event in software delivery — a commit was approved, a build completed, a deployment was authorized.
Not a log entry
A log entry says something happened. An attestation proves who said it happened, and that the statement hasn't been altered since. That difference is the entire reason CDK exists — logs are trusted because you trust the system storing them; attestations are trusted because the math checks out, independent of who's storing them.
Anatomy of an attestation
Every field earns its place. Here's the same example you'll see throughout these docs, annotated:
{
"event": "deployment.approved", // what happened
"actor": "[email protected]", // who — verified, not claimed
"artifact": "release-2026.07", // exactly what this is about
"policy": "release-policy-v3", // which rules were checked
"timestamp": "2026-07-28T09:41:00Z",// when, to the second
"signature": "sha256:8f92ab…", // proof none of this changed
"status": VERIFIED
}
Why signed, why not just logged?
A log entry is only as trustworthy as the system storing it — anyone with database access could edit it after the fact. A signed attestation is different: the signature is mathematically tied to the content. Change one character of the statement, and the signature no longer matches.
That holds whether or not you trust CDK's storage layer — which is the point. See the Security Architecture for exactly how the signing works.