Home / Knowledge hub / Cloud logging
Knowledge hub
Cloud logging
Switching on and keeping the provider's activity logs so you can answer what happened.
What it means
Cloud logging is the practice of switching on, collecting and keeping the activity logs your cloud provider can produce. They record who called which cloud API, from where and when: creating a server, changing a firewall rule, reading a storage object.
These logs describe the cloud account itself, which is different from your application's own logs. Some are on by default for a short time, and others are off until you configure them. The useful ones are the ones you chose to keep before you needed them.
Why it matters
When something goes wrong, the first questions are what was touched, by whom, and for how long. Without account logs the honest answer is that you do not know, and that is hard to say to a customer, a regulator or an insurer.
Logs also support audits. Frameworks such as SOC 2 and ISO 27001 expect evidence that you record and review important activity. Records that were never enabled cannot be recreated afterwards.
How it shows up
On AWS, CloudTrail keeps a rolling 90 days of management events you can browse by default. Keeping them longer needs a trail that writes to storage you control. Data events, such as reads of individual storage objects, are not recorded unless you ask for them. Other providers have their own equivalents.
The repeating mistakes are logs kept in the same account an intruder could reach, short retention, nobody reading them, and gaps across regions or accounts. Send logs to a separate, locked-down place and tie them into your monitoring and audit log practice.
Questions people ask
Cloud logging, answered
What is the difference between cloud logs and application logs?
Cloud logs record actions on the cloud account, such as creating a role or opening a port. Application logs record what your own software did, such as a failed sign-in. You need both to reconstruct an incident.
Are cloud logs on by default?
Partly. Providers record some management activity by default for a limited time. Longer retention, detailed data access records and logs from every region and account usually need to be set up on purpose.
How long should we keep them?
It depends on your contracts and regulators, so check those first. Many teams keep several months readily searchable and longer in cheaper storage. Whatever you choose, write it down and test that you can actually retrieve old records.
Can an attacker delete the logs?
If they gain enough access to your account, they can try. Send copies to a separate account with write-only access, turn on integrity checks where the provider offers them, and alert when logging is switched off.
Do logs prevent breaches?
No. They do not block anything. They let you detect misuse, scope an incident and prove what happened, which makes every other control easier to trust.
Related
Terms that sit next to this one
Logging and monitoring
Recording what happens, and actually watching what gets recorded.
Audit log
A record of who did what and when, kept so you can answer later.
Log retention
How long you keep logs, which decides whether you can investigate old incidents.
Incident response
The agreed plan for the hours after something has gone wrong.
SIEM
A system that gathers logs from everywhere and raises alerts on suspicious patterns.
Could you answer what happened?
Logs show what changed in your account. We show whether an outsider could reach your app, with the request, the response and the line of code behind each finding. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.