Forensic account
A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating the analysis prevents attacker IAM from reaching the evidence.