Cloud Audit Logging Baseline: Coverage, Protection, Integrity
Audit logging is an evidence system, not a console setting. During an incident, team needs reliable answer for who acted, what changed, where it happened, when it happened, and whether records remained protected. Design coverage, delivery, access, retention, integrity, and retrieval as separate controls.
Define coverage before collecting volume
Cover identity changes, authentication and federation activity, privileged role use, control-plane changes, network-security changes, key-management changes, storage-policy changes, and selected data-plane access. AWS CloudTrail management events cover management operations, while data events such as S3 object operations are not logged by default and can be high volume. Use focused selectors for sensitive buckets, prefixes, or operations and document cost owner.
Google Cloud Audit Logs distinguishes Admin Activity, Data Access, System Event, and Policy Denied. Admin Activity and System Event are always written; Data Access, except BigQuery behavior noted by Google, is commonly disabled by default and requires explicit configuration. Azure Activity Log captures management/control-plane operations by default; resource logs capture data-plane operations and require diagnostic settings. “Activity log enabled” therefore does not prove sensitive-data access is visible.
| Source | Required event set | Coverage proof | Owner | Result |
|---|---|---|---|---|
| AWS CloudTrail | organization/account management plus selected data events | trail and selector export; sample query | cloud security | pass/fail |
| Google Cloud | Admin, System, Policy Denied; selected Data Access | audit config and sink test | platform owner | pass/fail |
| Azure | Activity Log plus resource diagnostic settings | diagnostic setting and sample resource event | subscription owner | pass/fail |
| identity provider | sign-in, admin, MFA, federation | export timestamp and correlation test | identity owner | pass/fail |
Protect sinks from routine operators
Send logs to a separate security account, project, subscription, or workspace where feasible. Separate write, read, retention, and deletion authority. Routine workload administrators must not be able to disable collection, alter destination, shorten retention, or erase records without a monitored privileged path. Restrict sink policies to logging services and designated responders; alert on trail, sink, diagnostic-setting, bucket-policy, or retention changes.
Use encryption and access controls, but do not describe encrypted storage as immutable by itself. Integrity needs an explicit mechanism: provider validation features where applicable, append-only or write-once retention controls, restricted deletion, independent archival, and periodic verification. Google states Cloud Audit Log entries are immutable, but access and retention design still determine whether responders can retrieve them. Azure Activity Log is retained for 90 days by default; diagnostic settings export it for longer retention. Set retention from risk, legal, and cost decisions, not copied folklore.
Run retrieval and tamper tests
For each critical event, create a controlled test: make an approved policy change, access a protected object or secret where data-plane logging is intended, then retrieve correlated records from primary and protected destination. Capture event time, ingest time, actor/principal, request ID, resource ID, operation, result, source log, destination URI, query, and reviewer. Verify time synchronization across identity, cloud, application, and SIEM systems.
Test failure states too: a principal without sink access cannot delete logs; a workload administrator cannot disable delivery; an alert fires on configuration change; responders can access historical records using emergency procedure; retention prevents premature removal. Avoid placing secrets, presigned URLs, tokens, or raw customer payloads in application logs merely to improve investigation.
Complete artifact, exception, remediation
| Control | Evidence fields | Owner | Pass/fail | Exception | Remediation |
|---|---|---|---|---|---|
| Coverage | event matrix, selector/config version, sample event | security owner | pass/fail | approved data-event cost gap, expiry | enable focused source |
| Protected sink | destination, access-policy export, negative delete test | logging owner | pass/fail | migration window | remove routine admin authority |
| Retention | duration, lock/control, review date | risk owner | pass/fail | legal hold or cost approval | extend or archive records |
| Integrity/retrieval | validation result, query, correlation exercise | incident owner | pass/fail | provider limitation | add independent archive/check |
Every exception needs named approver, bounded scope, compensating control, expiry, remediation owner, and retest date. Revalidate after organization changes, new subscriptions/projects/accounts, service onboarding, and incident exercises. Infrastructure testing can validate approved logging controls.
Worked case: denied change reconstruction
Use controlled role to attempt an unauthorized configuration change, then locate generated audit event through normal investigation path. Expected output preserves time, actor, source identity, target, action, result, and correlation value needed to reconstruct event; test does not depend on a console screenshot. Delay and retention expectations must be documented as operational objectives, not assumed real-time guarantees. Compare central destination with source account and alert pipeline, noting any delivery gap.
Test malformed query, clock-skewed client, failed authentication, and configuration change made from approved automation. Closure package includes query text, event identifiers, immutable-storage or retention evidence where configured, alert disposition, and owner sign-off. If an exception disables a source or filter, define compensating detection, expiration, and independent check that logging has resumed. Close only after recovery test shows investigator can follow evidence without privileged ad hoc access.
Operational handoff: investigator records query range, assumed identity, source gaps, and conclusion in case record. On-call owner tests assigned-role read access before incident. Verify retention after destination changes. This turns logging into usable evidence, not a collection claim.
Final logging validation follows one approved and one denied action from source through retention destination and investigator query. Expected result: event identity, actor, time, and outcome remain available within policy. Edge case: clock drift changes apparent sequence; preserve source and ingestion timestamps. Close only after read access and recovery path work without emergency privilege.