Reviewing activity logs
As an auditor, one method that may be used to correlate processes and procedures that mitigate risk is to review activity logs. In cloud environments, these logs may be made up of separate sign-in and activity logs that are capturing activity for user accounts and service or workload identities. The activity may be occurring directly within the portal UI or through API calls by an identity. An important step in ensuring these various sign-ins and activities are being captured is to ensure that auditing has been enabled. This should not be assumed. There may be some auditing features enabled as default; however, this may not be a full set of what is required to satisfy a company’s control process, and the company should not rely on the cloud provider for managing the capture of these logs (refer to shared responsibility, discussed in Chapter 1, Cloud Architecture and Navigation, and Chapter 2, Effective Techniques for Preparing to Audit Cloud Environments...
