<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: auditing-cloud-logging-completeness
description: >-
  Verify that cloud logging covers all critical services including AWS CloudTrail,
  VPC Flow Logs, S3 access logs, GCP Audit Logs, Azure Monitor, and Kubernetes
  audit logs. Detect logging blind spots that would hide attacker activity.
domain: cybersecurity
subdomain: cloud-native-security
tags:
  - cloudtrail
  - vpc-flow-logs
  - audit-logs
  - gcp-audit
  - azure-monitor
  - logging
  - visibility
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1562.008"]
---

# Auditing Cloud Logging Completeness

## Overview

Incomplete logging creates blind spots that adversaries exploit. This skill
verifies that CloudTrail, VPC Flow Logs, S3 access logging, GCP Audit Logs,
Azure Activity Logs, and Kubernetes audit logs are enabled, retained, and
tamper-protected across all accounts and regions.

Mode: `[MODE: BLUE]` — Logging completeness audit. `[MODE: INCIDENT]` — Verify log availability during IR.

## Prerequisites

| Requirement | Details |
|---|---|
| AWS CLI with SecurityAudit access | Required |
| gcloud CLI with logging.viewer | Required |
| az CLI with Reader access | Required |

## Key Concepts

### AWS CloudTrail Audit

```bash
# Check trail status
aws cloudtrail get-trail-status --name default --output json

# Verify multi-region trail
aws cloudtrail describe-trails --output json | \
  jq '.trailList[] | {Name: .Name, IsMultiRegion: .IsMultiRegionTrail, LogFileValidation: .LogFileValidationEnabled}'

# Check for management event logging
aws cloudtrail get-event-selectors --trail-name default --output json

# Verify trail is logging
aws cloudtrail get-trail-status --name default --query 'IsLogging'

# Check S3 bucket logging for CloudTrail bucket
aws s3api get-bucket-logging --bucket CLOUDTRAIL_BUCKET
```

### VPC Flow Logs

```bash
# List VPCs without flow logs
for vpc in $(aws ec2 describe-vpcs --query 'Vpcs[].VpcId' --output text); do
  logs=$(aws ec2 describe-flow-logs --filter "Name=resource-id,Values=$vpc" --query 'FlowLogs[].FlowLogId' --output text)
  [ -z "$logs" ] && echo "NO FLOW LOGS: $vpc"
done

# Check flow log configuration
aws ec2 describe-flow-logs --output json | \
  jq '.FlowLogs[] | {VpcId: .ResourceId, Status: .FlowLogStatus, TrafficType: .TrafficType}'
```

### S3 Access Logging

```bash
# Check all buckets for access logging
for bucket in $(aws s3api list-buckets --query 'Buckets[].Name' --output text); do
  logging=$(aws s3api get-bucket-logging --bucket "$bucket" --query 'LoggingEnabled' --output text)
  [ "$logging" = "None" ] && echo "NO ACCESS LOGGING: $bucket"
done
```

### GCP Audit Logs

```bash
# Check audit log configuration
gcloud logging sinks list --format=json

# Verify data access logs enabled
gcloud projects get-iam-policy PROJECT_ID --format=json | jq '.auditConfigs'

# Check for log exclusion filters
gcloud logging sinks list --format=json | jq '.[].exclusions'
```

### Kubernetes Audit Logs

```bash
# EKS audit log status
aws eks describe-cluster --name CLUSTER --query 'cluster.logging.clusterLogging'

# GKE audit log status
gcloud container clusters describe CLUSTER --zone ZONE \
  --format='value(loggingConfig)'

# Check kube-apiserver audit policy (self-managed)
kubectl get pods -n kube-system kube-apiserver-* -o json | \
  jq '.spec.containers[].command[] | select(contains("audit-policy"))'
```

## Workflow

```bash
node scripts/agent.js --provider aws --output /tmp/logging-audit.json
cat /tmp/logging-audit.json | jq '.findings[] | select(.severity != "info")'
```

## Detection

```yaml
title: Auditing Cloud Logging Completeness Detection
id: c4173b78-890f-4aac-9191-2554153d2f43
status: experimental
description: Detects suspicious activity related to auditing cloud logging completeness techniques in cloud native security context
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    eventName: "*Unauthorized*"
  condition: selection
level: medium
tags:
  - attack.t1562.008
  - attack.privilege_escalation
falsepositives:
  - Kubernetes controller reconciliation loops during cluster updates
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Auditing Cloud Logging Completeness Detection | kubernetes | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1562.008 |

## Verification

- [ ] CloudTrail enabled, multi-region, with log file validation
- [ ] VPC Flow Logs enabled on all VPCs (ALL traffic type)
- [ ] S3 access logging enabled on sensitive buckets
- [ ] GCP Data Access audit logs enabled for all services
- [ ] K8s audit logging enabled at RequestResponse level
- [ ] Log retention meets compliance requirements (>=1 year)
- [ ] Log tamper protection (S3 Object Lock, immutable storage)

## References

- [AWS CloudTrail Best Practices](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/best-practices-security.html)
- [CIS AWS 3.x — Logging Controls](https://www.cisecurity.org/benchmark/amazon_web_services)
- [GCP Audit Logging](https://cloud.google.com/logging/docs/audit)
