Audit Logging in the Cloud: CloudTrail, Activity Logs and Beyond

The Record You Only Appreciate Once

Audit logging is the least rewarding thing to configure and the only thing that answers the question that matters after an incident: what exactly happened, when, and under whose identity.

Without it, an investigation produces a shrug. A key was exposed, you rotated it, and you have no idea whether it was used, what it touched, or whether something was left behind. Every subsequent decision becomes guesswork dressed as caution.

With it, the same situation becomes a query. You can state what the credential did, list resources it touched, and say with evidence whether anything changed. The difference in cost between those two outcomes is enormous, and the difference in setup effort is an afternoon.

Two Kinds of Record, Wildly Different Volume

Control plane events describe actions against the platform API: an instance created, a permission granted, a firewall rule changed, a key scheduled for deletion. Volume is modest, value is high, and this is what people mean by audit logging.

Data plane events describe access to the contents of a resource: an object read from a bucket, a function invoked, a row queried. Volume can be enormous and so can cost, which is why platforms usually leave these switched off until you ask.

The right approach is asymmetric. Turn control plane logging on everywhere without exception, and enable data plane logging selectively on the storage that holds sensitive material. Enabling data events across every bucket is how a logging project turns into a budget conversation.

Both are separate from application logs, which record what your own software did. All three feed an investigation and they answer different questions, and the collection pipeline for application output is covered in monitoring cloud servers.

What Each Platform Records

Two details catch people out. First, the browsable recent history in a console is a convenience view, not durable storage, and it will not cover the period an auditor or an investigation asks about. Configure delivery to storage you control.

Second, identity events often live in a different service from resource events. On Azure in particular, sign in activity is in Entra ID while resource changes are in the Activity Log, and an investigation needs both. AWS describes its own split between event types in the CloudTrail concepts documentation, and Google sets out its four categories in the Cloud Audit Logs documentation.

Reading a Single Entry

Whatever the platform, an audit record answers five questions, and knowing the shape makes queries much easier to write.

• Who: the identity, and importantly whether it was a user, a role assumed by something else, or a service acting on your behalf.
• What: the API operation name and the parameters it was called with.
• When: a timestamp, almost always in a single timezone across the whole feed.
• Where: the source network address, and often the user agent, which distinguishes a console click from a command line call.
• Outcome: success, or the error returned, which is how a permission probing sequence becomes visible.

The identity field repays attention. An entry showing a role rather than a person means the interesting question is which principal assumed that role, and the answer is usually a separate earlier event. Investigations frequently stall at this step because only the final action was retained.

Failed calls matter as much as successful ones. A burst of access denied errors across many services is one of the clearest signals that someone is exploring what a credential can reach.

One Destination, Written Once

Logs stored in the account they describe have an obvious weakness: anyone who compromises the account can edit or delete them. The standard answer is a separate archive account or project that receives logs from everywhere and grants almost nobody write access.

Organisation wide configuration matters too. Where a platform supports applying a trail across every account in an organisation, use it, because the alternative is discovering that the one account nobody remembered creating had no logging at all.

Then make the archive tamper evident. Object storage immutability features, marketed as object lock or immutable blob policies, prevent deletion until a retention period expires even by an administrator. Combined with integrity validation, they turn the archive into evidence rather than a file somebody could have edited.

Set retention deliberately, aligned to whatever framework applies to you. The service default is rarely the right answer, and the expectations behind these choices are discussed in cloud compliance basics.

The Short List Worth Paging For

A million records nobody reads is not a control. Pick a small set of events that are rare in normal operation and significant when they occur.

• A sign in as the account root or owner identity.
• A multi-factor device removed or an authentication policy relaxed.
• A new long lived access key created for any identity.
• A permission policy change granting broad administrative rights.
• A firewall or security group rule opened to the entire internet.
• A key scheduled for deletion, or an encryption setting disabled.
• Audit logging configuration modified or stopped.
• Repeated permission denied errors from one identity across many services.

Most of those connect to controls described elsewhere: the authentication events to multi-factor authentication for cloud accounts, the permission events to your least privilege design, and the key events to encryption at rest and in transit.

Route these somewhere a person will see, and review the list quarterly. An alert that has fired forty times without ever leading to an action is telling you the rule is wrong, not that the risk went away.

Practical Questions

Coverage and retention behaviour vary between platforms more than the marketing suggests. The Alibaba Cloud account listings describe an account where ActionTrail delivery is available, and the AWS versus Alibaba Cloud comparison looks at how the two organise account activity records.