9.2 Cloud Telemetry and Audit Logging (AWS CloudTrail, Azure Activity, GCP Audit)

Cloud Telemetry and Audit Logging (AWS CloudTrail, Azure Activity, GCP Audit)

Forensic reconstruction of cloud intrusions demands comprehensive visibility across distributed, API-driven architectures. Unlike on-premises networks where traffic passes through physical taps and local syslog daemons, cloud telemetry spans administrative audit logs, identity authentication streams, virtual network flow records, and managed threat intelligence engines. Incident handlers must understand the logging architectures and forensic telemetry sources across Amazon Web Services (AWS), Microsoft Azure, and Google Cloud Platform (GCP), while mastering log file integrity validation and indicators of cloud compromise.

AWS Telemetry Architecture

AWS provides foundational telemetry sources essential for cloud investigations:

• AWS CloudTrail: Serves as the authoritative record of API activity within an AWS account, capturing requesting IAM identities, timestamps, source IPs, user agents, API operations, request parameters, and response elements. CloudTrail distinguishes between two core event types:
  • Management Events: Capture control plane operations, such as launching EC2 instances, modifying security groups, attaching IAM policies, or configuring S3 buckets. CloudTrail Event history provides a 90-day regional view of management events without setup. A multi-Region trail or appropriately scoped event data store is needed for centralized, durable collection across enabled Regions; responders must also account for opt-in Regions and the organization's actual trail configuration.
  • Data Events: Capture high-volume data plane operations, such as s3:GetObject, s3:PutObject, and AWS Lambda function executions. Data events are disabled by default due to high log volume and ingestion costs. Responders investigating data exfiltration must confirm whether S3 data events were active; otherwise, CloudTrail cannot confirm which specific objects were accessed or downloaded.
• Log File Integrity Validation: To prevent adversaries from altering or deleting CloudTrail logs stored in Amazon S3 to cover their tracks, CloudTrail provides built-in Log File Integrity Validation. When enabled, CloudTrail delivers hourly digest files alongside standard log files. Each digest file contains SHA-256 hashes of delivered log files and the hash of the preceding digest file, forming an unbroken hash chain. CloudTrail digitally signs each digest file using an RSA private key managed by AWS. Responders execute aws cloudtrail validate-logs to verify signatures and hash-chain continuity and detect altered or missing delivered files within the validated range.
• CloudWatch Logs and VPC Flow Logs: Amazon CloudWatch Logs aggregates operational telemetry and application output, enabling metric filtering and automated alarms. Amazon VPC Flow Logs capture network IP traffic across virtual network interfaces (ENIs). Flow logs record 5-tuple connection data: source IP, destination IP, source port, destination port, protocol, packets, bytes, and action taken (ACCEPT or REJECT). VPC Flow Logs are indispensable for detecting command-and-control (C2) beaconing, network scanning, lateral movement, and unauthorized external data transfers.
• Amazon GuardDuty: A managed threat detection service that continuously evaluates CloudTrail event logs, VPC Flow Logs, DNS query logs, and Kubernetes audit logs. Using machine learning and threat intelligence feeds, GuardDuty detects unauthorized behaviors, including cryptocurrency mining, unexpected API calls from Tor exit nodes, and credential exfiltration via instance metadata.

Microsoft Azure Telemetry Ecosystem

Microsoft Azure centralizes security telemetry across several foundational services:

• Azure Activity Logs: Records control plane operations across Azure Resource Manager (ARM), providing visibility into resource creation, configuration updates, service health events, and administrative actions executed across Azure subscriptions.
• Microsoft Entra ID (formerly Azure AD) Audit and Sign-in Logs: Entra ID functions as the central identity provider. Sign-in logs capture interactive authentications, non-interactive logins, service principal requests, conditional access evaluations, MFA fulfillment, and sign-in risk levels (e.g., atypical travel, unfamiliar properties). Entra ID Audit logs track governance actions, including administrative role assignments (such as Global Administrator), group modifications, application registrations, and credential resets.
• Azure Monitor and Microsoft Defender for Cloud: Azure Monitor ingests metrics and log data into Log Analytics workspaces, enabling complex Kusto Query Language (KQL) threat hunting. Microsoft Defender for Cloud provides Cloud Security Posture Management (CSPM) and Cloud Workload Protection (CWPP), alerting responders to threats targeting VMs, SQL databases, and container registries.
• Virtual Network (VNet) Flow Logs: Capture layer-4 flow records at virtual-network scope and feed Azure Traffic Analytics. Microsoft stopped allowing creation of new NSG flow logs after June 30, 2025 and will retire existing NSG flow logs on September 30, 2027, so current designs should use VNet flow logs while preserving any historical NSG records needed for an investigation.

Google Cloud Platform (GCP) Telemetry Architecture

GCP organizes audit telemetry through Cloud Audit Logs across four distinct streams:

• Admin Activity Logs: Record administrative API calls that alter resource configurations or metadata (such as creating Compute Engine instances or changing IAM roles). These logs are immutable, enabled by default, and retained for 400 days at no cost.
• Data Access Logs: Record API calls that create, modify, or read customer data (e.g., BigQuery queries, Cloud Storage object reads). Data Access logs are disabled by default (except for BigQuery) and require explicit configuration.
• System Event Logs: Record administrative actions executed by automated GCP backend systems (such as VM live migrations).
• Policy Denied Logs: Generated when a security policy (such as Cloud IAM or VPC Service Controls) denies access to a resource.

GCP VPC Flow Logs record sampled network flows from virtual instances, while Security Command Center (SCC) acts as the centralized vulnerability and threat detection dashboard, surfacing misconfigurations, compromised service accounts, and exfiltration anomalies.

Detecting Suspicious Cloud Activity and Indicators of Attack

Incident handlers must configure detection rules and hunt for high-fidelity indicators of adversary cloud activity:

• Defense Evasion: Adversaries frequently attempt to disable logging upon acquiring credentials. Responders must alert on API calls such as StopLogging, DeleteTrail, and UpdateTrail in AWS, disabling diagnostic settings in Azure, or deleting log sinks in GCP.
• Authentication Anomalies: High-risk indicators include ConsoleLogin events executed without MFA, logins originating from commercial VPNs or Tor exit nodes, impossible travel alerts (logins from distant regions within impossible timeframes), and unexpected access key creation (CreateAccessKey) on dormant accounts.
• Privilege Expansion: High-risk indicators include policy tampering (e.g., AttachUserPolicy, PutRolePolicy granting wildcard *:* permissions), modifying IAM trust policies, or registering unapproved external identity providers.
• Mass Data Egress: Spikes in s3:GetObject requests, massive outbound byte counts in VPC Flow Logs, and large-scale snapshot sharing across external account IDs signal active data exfiltration requiring immediate containment.