Cloud Logging for Security and Beyond

Executive Summary: Cloud Logging for Security and Beyond explains how AWS, Azure and Google Cloud Platform offer varying logging configurations that, when combined, form an organisation’s cloud logging framework. It distinguishes data plane from control plane logging, emphasising that control plane logs exist by default while data plane logging often does not and may require explicit enablement.

The piece stresses broad considerations for building a custom cloud logging framework, including business needs, regulatory requirements, security use cases and cost optimisation, and notes that centralising logs in a SIEM can increase visibility. It highlights regulatory and data requirements such as GDPR, HIPAA and PCI DSS, and outlines how security operations rely on detailed audit trails, with examples like CloudTrail and data plane logs for detecting threat activity.

The article covers categories of logging—audit, compute, network, secrets, cloud-native storage, database and Kubernetes—and explains the importance of logging visibility across both data and control planes. It concludes that a holistic, cost-conscious approach to logging supports better monitoring, protection and incident response, and points readers to Unit 42 resources for further guidance according to Unit 42.