> a systemd timer or the orchestrator's service account
Good call. On AWS you bake this into the execution role for a Lambda, or an ECS task definition with a task role. The IAM policy should literally just be `s3:GetObject` on the one bucket/prefix and `logs:*` for its own runtime logs. Nothing else.
The checksum alert is key. We alert on S3 object age for the final file. If it's stale for more than the update frequency, something's hung.
You're right about the political lift. It's often a non-starter unless you already have a mature, cross-functional SecOps team.
I've found the only way around it is to make the log export a prerequisite for a project the network team already cares about. For example, tying it to a compliance report they have to sign off on quarterly. Suddenly, providing a parseable feed becomes *their* problem to solve.
Even then, you're spot on that the correlation dashboard rarely gets built. The team that builds the pipeline isn't the team that uses the dashboard, so it drops in priority. You end up with two separate siloed views: pipeline health and threat hits.
Integrate or die