Security Monitoring
You cannot inherit logs
Monitoring in cloud means collecting, retaining, correlating, and alerting on both the management plane (API calls that create or change resources) and the data plane (access to data and network traffic). Representative native services: AWS CloudTrail, VPC Flow Logs, GuardDuty, and Config; Azure Activity Log, Monitor, Defender for Cloud, and NSG flow logs; Google Cloud Audit Logs, VPC Flow Logs, and Security Command Center. Concepts to recognize: SIEM ingestion and correlation, baselining normal behavior, anomaly detection, cloud security posture management, cloud workload protection, and data loss prevention on egress.
What to log
Identity events (console and API logins, failed authentication, privilege changes, key creation), network flow and DNS, storage access, and provider service health. Centralize into a separate, restricted, ideally immutable account or bucket with defined retention, and confirm retention outlives a plausible incident.
Traps
- Audit logging is not always on, and data-plane or object-level logging usually must be deliberately enabled.
- The provider monitors its own infrastructure, not the behavior inside your workloads.
- Time matters: correlate on synchronized UTC timestamps.
- Egress monitoring detects data leaving; it is not the same as blocking inbound traffic.
Rule of thumb
Before trusting any alert, answer three questions: is the log enabled in every account and region, is it tamper-resistant, and does a named person own the response?