What is a cloud audit log?¶

A cloud audit log records significant actions within a cloud service, platform or tenant.

It may include sign-ins, administrative changes, file activity, permission changes, resource creation, API calls and security events.

Avoid this assumption: That a cloud audit log is automatically complete, permanent and directly attributable to the named user. That should not be assumed.

Cloud providers divide activity across different products, services and log types. Some records are enabled by default; others require configuration, licensing or additional retention. A dashboard may combine source events from several systems or present only a filtered view.

A cloud audit entry may include an account, service principal, action, target resource, result, source IP address, device details, session or request ID and timestamp. This can provide strong evidence that the cloud platform recorded a particular action.

But the actor field may identify an account, application, API token or automated service rather than a person. Administrators may act on behalf of users. Existing sessions and delegated permissions can also produce apparently normal activity without a new login.

Investigators should establish the provider, tenant, product and audit-log source. Ask which logging features were enabled, what licence or retention applied and whether the export contains all available fields. Preserve original provider records promptly, including correlation IDs and relevant configuration.

Where important activity is alleged, obtain the linked authentication, application, file, mailbox, API or resource records. Correlate with endpoint and network evidence and distinguish provider-recorded action from personal attribution.

Operational takeaway¶

A cloud audit log can show that a cloud platform recorded an action against an account or resource, but completeness, retention, automation and personal attribution must be established from the actual service.