Audit trails: prove which data-plane actions are recorded

Last updated: 5 Oct 20266 min read

tutorial

Cloud audit systems distinguish control-plane actions from data-plane activity. A trail may record role and bucket configuration changes while omitting high-volume object reads, writes, or function invocations unless selectors include those resource types and actions. Selectors are part of the evidence contract: an investigator needs to know which action, resource prefix, account, and period were covered, and when the configuration changed.

Operational decision

A payments archive must investigate who retrieved payout exports. Before claiming read visibility, inspect the active event selectors and confirm that the archive's object resource type, bucket prefix, and read operations are included. Compare the selector with one successful read and one denied read from disposable test identities; locate the resulting records by request time and resource. Then test a write and a delete separately, because a selector restricted to reads cannot answer who altered an object. Keep management events in the proposed selector when changing from basic to advanced mode; replacing selectors without carrying forward existing coverage creates a blind interval. Scope high-volume data events by approved prefixes and actions to control charges, but document exclusions as investigative limits. Record delivery delay and the clock skew of the test client so an apparent missing event is not simply a search-window error. Do not use an audit trail as synchronous access control: the request is authorized before the event is delivered. For incident review, correlate cloud request IDs with application records while protecting customer object keys in the query output.

Payout archive event-coverage matrix
Role and policy change: management event
Object read: archive prefix data event
Object write: archive prefix data event
Object delete: archive prefix data event
Approved and denied probes: request IDs retained
Selector change: prior coverage compared before and after

Cost and verification

Logging cost often scales with selected event volume; broad object-read capture can be much larger than management-event volume. A review of E events is O(E) to scan without a suitable index, so retain queryable partitions and bounded time windows. Measure probe-to-delivery delay, missing probe events, excluded prefixes, and event volume by operation. If an audit record is absent, check selector scope and delivery health before concluding the operation never happened.

Common Mistakes

Do not infer object-read coverage from role-change events.
Do not replace selectors without comparing old and new coverage.
Do not equate missing search results with proof an operation did not occur.

Connected lessons

Practice and check

devops

cloud-security