Cloud Security Monitoring: AWS, Azure, and GCP Logs to Watch

Cloud security monitoring is the continuous collection and review of control-plane, identity, workload, and network logs from cloud accounts to find and investigate attacker activity. Many programs start from the provider defaults, and those mostly record management activity in the control plane. The evidence an investigation depends on is usually off by default, sampled, or billed per event: object reads, service account impersonation, sign-in exports, and flow records.

AWS keeps 90 days of management events in CloudTrail Event history for free, Azure collects the Activity Log with no configuration, and GCP writes Admin Activity logs you cannot disable, but none of those defaults covers the data plane. In a 2024 extortion case against S3 buckets, Unit 42 found that neither CloudTrail S3 data events nor S3 server access logging had been turned on, so no logs showed the exfiltration.

TL;DR:

• Default-on cloud logs record management activity, and the data-plane evidence you need during an incident is opt-in: S3 data events, GCP Data Access logs, Azure resource logs, and flow logs all have to be turned on.
• Unexpected identity changes are the first events to alert on in all three clouds: new access keys, trust policy edits, service principal credentials, and service account impersonation.
• Logging changes belong in the same top tier, because detections built on your own logs can keep running quietly after the source beneath them is disabled or filtered.
• A cloud alert is useful only once someone investigates it, and that means correlating control-plane, identity, workload, and business context.

What Each Cloud Logs by Default, and What It Doesn't

Volume and cost explain most of what stays off. Google disables Data Access logs by default for every service except some BigQuery services, because they can generate large volumes of data, and AWS charges $0.10 per 100,000 data events delivered to S3, with no free copy. The table shows what each provider turns on by default and how long it keeps it.

‍

Entra retention changes are not retroactive. A tenant that upgrades from Free to P1 keeps only data within the free period, up to seven days, and older data is unrecoverable unless it was archived. In Azure, a management-group diagnostic setting does not capture subscription-level events that lack the hierarchy property, so Microsoft recommends a setting on each subscription you need to monitor.

GCP records the IAM credentials methods GenerateAccessToken, SignBlob, and SignJwt as Data Access logs. With Data Access logging off, the token-generation call behind service account impersonation leaves no audit entry, though actions taken with the impersonated identity can still appear in the logs of the services it touches. Check that any impersonation detection, including Datadog's default impersonation rule, reads Data Access logs, because a rule scoped to Admin Activity logs alone would miss GenerateAccessToken.

AWS retention planning also shifted in 2026. CloudTrail Lake closed to new customers on May 31, 2026, though existing customers can keep using it, and AWS now points new log analytics toward CloudWatch.

Advanced event selectors keep data-event costs down by filtering data events on eventName, resources.ARN, or readOnly, so you can start with the buckets, functions, and tables holding data you would have to disclose. A 2021 AWS post calls recording all data events best practice for auditing. Scoped logging sits between that and nothing, and selectors cannot recover events you chose not to log.

The Events Worth Alerting On

The events most worth alerting on in every cloud fall into two groups: identity changes and logging changes. The lists below draw on vendor detection content and attacker research, none of which amounts to a formal fidelity ranking, so treat the order as a starting point.

AWS: CloudTrail

Alert first on these:

• Logging changes: StopLogging, DeleteTrail, UpdateTrail, and PutEventSelectors, which can filter out all management events.
• New identities: CreateUser, then AttachUserPolicy, CreateLoginProfile, and CreateAccessKey. Attackers frequently try to create an IAM user shortly after compromising an AWS environment.
• Trust changes: CreateRole with a malicious assumeRolePolicyDocument, and UpdateAssumeRolePolicy adding an outside principal.
• Console logins without MFA, and spikes in GetObject or ListObjects calls, which only appear when S3 data events are on.

Treat GetCallerIdentity as supporting evidence at most. The JavaGhost group avoids that call because defenders frequently expect attackers to use it during initial compromise.

Azure: Activity Log and Entra ID

In a 2025 Storm-0501 intrusion, after compromising an Entra Global Administrator, the actor called Microsoft.Authorization/elevateAccess/action, then used Microsoft.Authorization/roleAssignments/write to assign itself Owner over every Azure subscription it could reach. Both events belong at the top of an Azure watch list. Below them:

• Credentials added to existing applications or service principals, which Microsoft's application security operations guidance rates High.
• Highly privileged delegated permissions granted on behalf of all users, also rated High, while end-user consent alone rates Low.
• Conditional Access changes and federation setting changes on a domain.
• Key Vault access policy changes and disabled or deleted diagnostic settings.

Service principal credentials deserve extra weight because user-targeted Conditional Access policies don't cover them. Conditional Access for workload identities can cover single-tenant service principals with a Workload Identities Premium license. It excludes multitenant apps and managed identities. Outside that coverage, a new secret on an app may bypass the controls built for users.

GCP: Cloud Audit Logs

GCP's high-signal events center on service accounts:

• SetIamPolicy on a service account, especially impersonation grants to external principals.
• TokenCreator grants at the organization, folder, or project level, each with its own Event Threat Detection finding.
• CreateServiceAccountKey, mapped to T1098.001.
• DeleteSink and UpdateSink, which are Admin Activity events and get logged even with Data Access logging off.
• A burst of PERMISSION_DENIED errors from a service account, which Google's excessive permission denied finding treats as a possible sign of a compromised identity.

Google's H1 2026 Threat Horizons report recommends YARA-L 2.0 rules in Google SecOps that would flag, for example, a CI/CD service account calling projects.iam.setIamPolicy to grant roles/owner to a new, unknown identity.

Identity Is the Entry Point, and Automation Is the Noise

Valid account abuse accounted for 35% of cloud incidents in CrowdStrike's 2026 report. Long-lived credentials give attackers material, and they remain common. Among identities that still use static keys in Datadog's 2025 State of Cloud Security sample, 59% of AWS IAM users had one older than a year, as did 55% of Google Cloud service accounts and 40% of Entra ID apps with password credentials.

The events attackers use are the same ones your pipelines generate all day. Elastic's impersonation-grant rule notes that Terraform, Deployment Manager, and CI/CD service accounts commonly grant serviceAccountUser and serviceAccountTokenCreator during normal provisioning.

Detection guidance handles that noise with narrow exceptions. Elastic advises baselining provisioning principals and excluding them by name. Splunk's service principal detection is meant to run after a baseline of service principal sign-ins exists.

A 2021 Sigma rule for AssumeRole misuse asks reviewers to check whether the user identity, user agent, and hostname should be making the change, and Elastic's access token rule counts distinct source IPs per access key in 30-minute windows. One-time grants are better validated against change management than suppressed.

An allowlist built only from Terraform state leaves a gap, because CI/CD pipelines, scripts, and third-party tools can change resources that Terraform never sees.

Logging Is Part of the Attack Surface

When an attacker disables, suppresses, or filters a log source, a detection built on it keeps running silently and generates no alerts. In LLMjacking campaigns, attackers checked the logging configuration to see whether Bedrock invocation logging was on, and later campaigns called DeleteModelInvocationLoggingConfiguration to turn it off. None of the clients affected by the malicious Bedrock use Permiso investigated in 2024 had invocation logging enabled.

Attackers can also hide a policy's contents without touching logging settings: whitespace-padded IAM policies can exceed CloudTrail's 100 KB requestParameters limit, so the event is logged without the policy contents. Policy-change events with omitted parameters deserve a closer look. Credentials stolen through IMDS generate no AssumeRole event, and Sysdig recommends the ec2RoleDelivery field to tell IMDSv1 delivery from IMDSv2.

Put tamper events (trail changes, sink deletion, diagnostic-setting removal, and GuardDuty or Security Hub disablement) in your top priority tier. Then watch detector coverage itself: which accounts and Regions have GuardDuty and its protection plans enabled, and whether logs are still arriving where you retain them. Trail changes won't blind GuardDuty, which reads its own copy of CloudTrail events, but they do cut the evidence you keep and anything your SIEM builds on it.

Native Detectors Read Logs You May Not Keep

GuardDuty consumes VPC flow log data through an independent, duplicate stream and works without your flow logs, but you can't query that stream during an investigation. S3 Protection works the same way: it analyzes CloudTrail data events for S3 without you turning on data-event logging. You get findings but no object-level record of your own.

Google's Event Threat Detection makes the same trade. Without VPC Flow Logs, investigating a finding means turning them on and then working in Logs Explorer and Flow Analyzer by hand, and links to those tools appear only on findings generated after you enable them. Turning flow logs on later doesn't recreate a record of the traffic you missed.

GuardDuty turns on most protection plans when first enabled, but Runtime Monitoring stays off. SCC's Event Threat Detection, Container Threat Detection, and VM Threat Detection require Premium or Enterprise, and the Enterprise tier shuts down on May 21, 2027, with organizations moving to Premium. Defender for Resource Manager is a paid plan at about $5 per subscription per month, and its suspicious role-assignment alert ships at Informational severity with a note that the activity might be legitimate.

Workload telemetry covers what the control plane misses, and it is mostly opt-in too. EKS control-plane logs aren't sent to CloudWatch by default and carry CloudWatch Logs charges once enabled, AKS audit logs need a diagnostic setting, and GCP disables VPC Flow Logs on new subnets unless you enable them.

Sysdig's July 2023 SCARLETEEL 2.0 investigation tracked attackers who stole credentials from containers through IMDSv1, then ran Pacu to find privilege escalation paths, carrying an intrusion that began on the workload into the control plane.

How a Cloud Alert Becomes a Verdict

Triage routes an alert, and investigation decides whether it is real. SpecterOps's funnel of fidelity, first published in 2019, sorts alerts into known bad, known good, or unknown and sends the unknowns to investigation. Many cloud alerts land in unknown, because the event alone rarely says whether the principal should be doing that.

A verdict requires pulling from several sources:

• The control-plane trail for the principal across the window.
• Identity provider logs: interactive, non-interactive, and service principal sign-ins, plus risky user detections.
• Workload configuration: instance profile permissions, AMI, IMDS version, and network exposure.
• Flow and DNS records for lateral movement.
• Business context: resource owner, criticality, whether the change was approved, and prior verdicts for the same identity.

Each source sits in a different console or query language. Cross-source correlation is notoriously hard, and keeping track of who owns each alert ranks among the hardest parts of security operations.

In a June 2026 report on an AWS breach suspected to follow a Shai-Hulud infection, FortiGuard Labs credited correlation tooling with removing the need to connect more than 1,300 CloudTrail events spanning six hours by hand. Cloud detection and response tools add their own alerts to an already crowded queue, and identity compromise that spreads into SaaS applications brings audit trails from yet another set of consoles.

How to Prioritize Cloud Security Monitoring Logs

The right first step depends on what you run and what you already collect:

• With only a multi-Region trail, add S3 data events on sensitive buckets, scoped with advanced event selectors.
• On Entra Free, move to P1 or P2 for 30-day sign-in retention, and configure a diagnostic setting before you need the logs.
• Where GCP pipelines use service account impersonation, turn on Data Access logs for the IAM API (iam.googleapis.com) or for all services, since the IAM credentials API can't be enabled on its own.
• On Kubernetes, turn on EKS control-plane logs and AKS audit logs for each cluster, and GKE Data Access logs for each project.
• With Bedrock in use, turn on model invocation logging in each account and Region, confirm it covers your endpoints (it captures bedrock-runtime calls only), and alert on DeleteModelInvocationLoggingConfiguration.

Every step on this list adds evidence that someone then has to investigate.

What Changes When Every Cloud Alert Gets Investigated

For teams that already collect this telemetry, the constraint in cloud security monitoring shifts from collecting signals to resolving them. Native detectors, CDR tools, and custom rules on CloudTrail or Activity Log data often produce alerts faster than a team can assemble the context above, so teams investigate the critical alerts and let the rest age. The alternative is to investigate every alert upfront, with telemetry, organizational, and historic context pulled automatically, and to agree response authority before an incident starts.

Daylight is a MASS company, meaning it offers managed agentic security services for Security Operations. Its cloud MDR service investigates alerts across cloud audit streams and identity-provider telemetry, with response authority for credential, session, and workload actions agreed at onboarding.

Frequently Asked Questions About Cloud Security Monitoring

How Is Cloud Security Monitoring Different From CSPM?

CSPM checks configuration state against policy, such as a public bucket or a missing MFA requirement, while cloud security monitoring watches activity in logs, such as who read the bucket or who changed the policy. Many programs need both, because a posture finding tells you an exposure existed and the activity logs show whether anyone used it.

How Fast Does Cloud Log Data Arrive?

CloudTrail delivers events about five minutes after an API call on average, with no guarantee. Azure Activity Log entries usually appear within three to 20 minutes, and when you first route Entra activity logs to a Log Analytics workspace, they can take up to three days to appear. Measure latency in your own pipeline. The fastest eCrime breakout CrowdStrike observed in 2025, across all environments, took 27 seconds according to its 2026 report, so time-sensitive identity detections are better fed from streaming sources than from batch delivery.

How Long Should We Retain Cloud Logs?

Longer than the defaults. In the 2024 extortion case Unit 42 investigated, the actor waited almost a month after its discovery operations before taking disruptive actions. GCP's 30-day _Default bucket would barely cover that wait, so lengthen its retention, and export Activity Log events or pay for retention beyond Azure's 90 days.

What Happens to Azure NSG Flow Logs?

They retire September 30, 2027, and Azure no longer accepts new NSG flow logs. After retirement, traffic analytics stops working for them and Azure deletes existing NSG flow log resources, though records already in storage keep their retention policies. VNet flow logs replace them, collecting at one-minute intervals with 5 GB/month free per subscription, plus separate storage charges.

Which Log Tier Should Cloud Telemetry Go Into?

Keep identity and control-plane logs, which most investigations query, in an analytics tier, and push flow logs and high-volume data events to cheaper tiers. The price gap is wide: at US East pay-as-you-go rates, Azure Monitor's Analytics tier costs $2.30/GB against $0.05/GB for Auxiliary, and AWS charges $0.25/GB to deliver VPC flow logs to S3 against $0.50/GB to ingest them into CloudWatch Logs. Lower-cost tiers usually limit query features and alerting. Weigh what you give up during an investigation alongside the ingestion price.