What records might a cloud provider hold?¶

Cloud providers record the customer account and resources created through their control systems. They may have much less visibility inside customer-managed applications.

Control plane and customer workload¶

The control plane is where users create virtual machines, storage, networks, databases and permissions. Records may include account users, roles, authentication, API activity, resource creation and deletion, assigned IP addresses, regions, billing, security alerts and support.

The workload is what runs inside those resources. Web-server logs, files and application data may remain solely within a customer-controlled virtual machine or database unless a managed logging service was configured.

It is like a storage company recording who rented a unit, when access was granted and which unit was allocated, without keeping an inventory of everything stored inside.

Identify the exact product and resource: a virtual machine, object store, serverless function and managed website platform create different records. Resource identifiers and timestamps are more reliable than a general request about an IP address.

Cloud resources can be short-lived, and addresses can be reassigned. Resellers and managed-service providers may sit between the cloud company and end user.