Cloud platform that logs every administrative action for security audits

If you’re looking for the term, it’s cloud audit logging. Examples include AWS CloudTrail, Google Cloud Audit Logs, and Azure Activity Logs—they record administrative activity for security reviews. (docs.aws.amazon.com)

If you meant a specific product or want a recommendation, tell me which cloud provider you use.

The major cloud providers each have a built-in service for this. The three main ones are:

• AWS CloudTrail: It keeps a history of API calls in your account, including who made the call, when, from which IP, and whether it succeeded. AWS's audit log service, CloudTrail, provides a history of API calls made in your AWS account. This includes details like who made the call (which user or role), when, from what IP, which API was called with what parameters, and whether it succeeded.

• Google Cloud Audit Logs: Admin Activity logs are always on and can't be turned off, which gives you a baseline trail. Data Access logs are a separate category. They are always on and cannot be disabled, which means you always have a baseline audit trail. Data access logs are often off by default because they generate much higher volume, so a common approach is to turn them on only for resources that hold regulated or sensitive data.

• Microsoft Azure Activity Log: It covers control-plane operations in a subscription. For audit purposes, you send the data to a Log Analytics workspace or archive it. You route Activity Log data to a Log Analytics workspace where you can query it, set up alerts, and retain it for as long as your compliance framework requires. The default retention is 90 days, but most regulated environments archive to storage accounts for years.

Other platforms with similar features include IBM Cloud Activity Tracker and Confluent Cloud audit logs. Confluent writes its records to a separate audit log cluster. Each auditable event record includes information about who tried to do what, when they tried, and whether the system gave permission to proceed.

Which one fits depends on your provider. If you're on one cloud, use its native service. If you run across several, most teams send these logs to a SIEM for correlation and long-term analysis. Also, keep in mind that retention and tamper resistance are set up separately from the logging itself. Several services support immutable or write-once storage, where logs cannot be changed or deleted after they are written.

I didn't check current pricing or retention limits for each service, so confirm those in the provider's documentation before you rely on them for an audit.

All major cloud service providers offer native, built-in logging services specifically designed to record administrative and management actions for security audits. These services are considered essential for maintaining accountability, troubleshooting, and meeting regulatory compliance requirements.

The following are the primary audit logging tools for the three major cloud platforms:

1. AWS (Amazon Web Services): AWS CloudTrail

AWS CloudTrail is the primary service for tracking user activity and API usage across your AWS environment.

• What it logs: It records nearly every action taken in your account via the AWS Management Console, CLI, SDKs, or other services. This includes "Management Events" (control plane operations like creating, modifying, or deleting resources).
• Key Features: It is enabled by default upon account creation to provide 90 days of event history. For long-term audit needs, you can create "trails" to deliver logs to an Amazon S3 bucket for indefinite retention and further analysis.
• Usage: It provides the "who, what, when, and from where" for every API call, making it a critical tool for security investigations and governance.

2. Google Cloud (GCP): Cloud Audit Logs

Google Cloud’s Audit Logs are a feature of the Cloud Logging service and are divided into specific categories based on the type of activity.

• What it logs:
  • Admin Activity Logs: These are enabled by default and cannot be disabled. They record API calls and administrative actions that modify the configuration or metadata of resources.
  • Data Access Logs: These track operations that read or write user-provided data. These are generally disabled by default (due to volume) and must be explicitly enabled for high-security environments.
• Key Features: These logs are integrated into Google Cloud’s broader observability suite, allowing for easy filtering, querying, and exporting to external SIEM tools.

3. Microsoft Azure: Azure Monitor Activity Log

Azure uses the "Activity Log" within Azure Monitor to track operations on resources in your subscription.

• What it logs: It captures control plane operations—such as creating, updating, or deleting resources—performed through Azure Resource Manager.
• Key Features: Activity logs are collected by default and retained for 90 days. For compliance purposes, you can create "Diagnostic Settings" to stream these logs to a Log Analytics workspace for longer retention, advanced querying, and integration with security solutions.

Summary Comparison

Important Implementation Tips for Security Audits

• Centralize Logs: For robust security, it is best practice to export these logs to a centralized, immutable storage location (like an S3 bucket with Object Lock, a protected Log Analytics workspace, or a dedicated SIEM tool).
• Retention Policies: While providers offer default retention (often 90 days to 13 months), regulatory frameworks (e.g., SOC 2, HIPAA, GDPR) may require you to retain logs for several years.
• Alerting: Do not rely on logs only for post-incident review. Configure alerts (e.g., CloudWatch Alarms, Azure Monitor Alerts) to notify your security team in real-time when sensitive administrative actions occur.

If you’re looking for a cloud platform that records administrative actions for security audits, AWS CloudTrail is one option. It records user and API activity across AWS, including who performed an action and when. For a continuous, longer-term audit record, configure a CloudTrail trail to deliver events to storage; the console’s Event History covers the past 90 days of management events. ¹²

Google Cloud offers a similar feature, Cloud Audit Logs: Admin Activity logs record changes such as creating resources or changing IAM permissions, and are always written. ³