A cloud logging strategy: what to log, central storage, retention and protection
In short: A good logging strategy decides in advance what to collect, where it goes and how long it is kept. Prioritise control plane audit logs, identity sign-ins, network flows and key workload logs, send them to a separate protected account, use tiered retention and make the archive tamper-resistant.
Why plan logging
When an incident happens, the first question is usually "what do the logs show?" Too often the answer is that the relevant log was never enabled, was kept for only a week or was deleted by the attacker. In the cloud many important logs are off by default or kept briefly unless you configure them. A logging strategy fixes this before you need it, and supports compliance requirements under frameworks such as ISO/IEC 27001:2022 and PCI DSS.
What to log first
| Priority | Source | Examples |
|---|---|---|
| 1 | Control plane audit logs (who changed what) | AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs |
| 1 | Identity and sign-in logs | Entra ID sign-in and audit logs, IAM Identity Center, Okta |
| 2 | Data access logs for sensitive stores | S3 data events, Key Vault and KMS access, database audit |
| 2 | Network flow logs | VPC Flow Logs, VNet flow logs, firewall and WAF logs |
| 3 | Workload logs | Kubernetes audit, OS security logs, application logs |
| 3 | Security service findings | GuardDuty, Defender for Cloud, Security Command Center |
Each useful log entry should answer who, what, when, where (source IP, region, resource) and the outcome. Keep clocks synchronised; cloud services use UTC, so store and display times in UTC to avoid confusion during investigations.
Do not log secrets, full card numbers or unnecessary personal data. Logs are often read by many people and kept for years, and they fall under data protection law such as the UK GDPR.
Centralise and protect
Send logs from all accounts or subscriptions to a dedicated log archive account or workspace that workload teams cannot administer. Organisation-wide features make this easier, such as an AWS Organizations trail or Azure diagnostic settings applied by policy. Then:
- Make the archive immutable using write-once storage such as S3 Object Lock or Azure immutable blob storage.
- Restrict who can stop logging, change retention or delete logs, and alert on any attempt.
- Encrypt logs, ideally with a customer-managed key in the security account.
- Enable integrity validation where offered, such as CloudTrail log file validation.
Tip: attackers often try to disable logging early. An alert on "trail stopped" or "diagnostic setting deleted" is one of the most valuable detections you can build.
Retention and cost
Set retention from three inputs: legal and regulatory requirements, how long attacks often go unnoticed (which can be months), and budget. A common pattern is 30 to 90 days in a searchable SIEM tier, then a year or more in cheap archive storage that you can restore or query when needed. Reduce cost by filtering noisy, low-value events before ingestion rather than by cutting security-critical sources.
- List required sources per account and enable them by policy.
- Route everything to the central log account.
- Define retention per source and apply lifecycle rules.
- Lock down and monitor the log store.
- Test: can you answer "who deleted this resource last month?" within minutes?
Practice
Why should logs go to a separate account that workload admins cannot control?
Name two log sources you would enable first in any cloud account.
How can you cut logging costs without losing key evidence?
Key takeaways
- Plan logging before an incident; many cloud logs are off by default.
- Start with audit, identity, data access and network flow logs.
- Centralise logs in a separate, locked-down account.
- Use immutable storage and alert on attempts to stop logging.
- Set tiered retention from legal needs, dwell time and budget.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.