Cloud attacks rarely touch a host you control - so your servers' EDR sees nothing. In the cloud, the audit log is your endpoint: AWS CloudTrail, Azure Activity/Entra logs, GCP Cloud Audit Logs record every API call.
What it captures
Every action - who (identity), what (API call), when, from where (IP), and the result. That's the raw material for detecting cloud intrusions: key creation, policy changes, data access, resource sharing.
Events worth alerting on
- Logging tampering -
StopLogging,DeleteTrail, or config changes that disable/redirect logs. This is often the attacker's first move. - Identity escalation -
CreateAccessKey,AttachUserPolicy(admin),CreateUser. - Data exposure -
PutBucketPolicy/PutBucketAclgranting public access; external snapshot/AMI sharing. - Root / no-MFA console logins.
Why attackers silence it
If they can stop or delete the trail, their later actions go unrecorded. So treat "logging disabled" as a high-severity, standalone alert - and protect it: send logs to a separate, locked-down account, enable log-file validation, and make the trail immutable.
Your cloud is only as observable as your audit log - guard it like the crown jewel it is.