<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Cloud Logging Completeness — API Reference

## AWS CloudTrail

```bash
# Describe trails
aws cloudtrail describe-trails --output json

# Get trail status
aws cloudtrail get-trail-status --name TRAIL_NAME

# Get event selectors
aws cloudtrail get-event-selectors --trail-name TRAIL_NAME

# Lookup events
aws cloudtrail lookup-events --lookup-attributes AttributeKey=EventName,AttributeValue=ConsoleLogin

# Create trail
aws cloudtrail create-trail --name org-trail --s3-bucket-name BUCKET \
  --is-multi-region-trail --enable-log-file-validation
```

## VPC Flow Logs

```bash
# Describe flow logs
aws ec2 describe-flow-logs --output json

# Create flow log
aws ec2 create-flow-logs --resource-type VPC --resource-ids VPC_ID \
  --traffic-type ALL --log-destination-type cloud-watch-logs \
  --log-group-name vpc-flow-logs

# Describe VPCs
aws ec2 describe-vpcs --query 'Vpcs[].VpcId' --output text
```

## S3 Access Logging

```bash
# Get bucket logging
aws s3api get-bucket-logging --bucket BUCKET

# Put bucket logging
aws s3api put-bucket-logging --bucket SOURCE_BUCKET \
  --bucket-logging-status '{"LoggingEnabled":{"TargetBucket":"LOG_BUCKET","TargetPrefix":"s3-logs/"}}'
```

## EKS Logging

```bash
# Describe cluster logging
aws eks describe-cluster --name CLUSTER --query 'cluster.logging'

# Enable audit logging
aws eks update-cluster-config --name CLUSTER \
  --logging '{"clusterLogging":[{"types":["audit","authenticator","controllerManager","scheduler","api"],"enabled":true}]}'
```

## GCP Audit Logs

```bash
# List sinks
gcloud logging sinks list --format=json

# Read audit logs
gcloud logging read 'logName="projects/PROJECT/logs/cloudaudit.googleapis.com%2Factivity"' --limit=10

# Check audit config
gcloud projects get-iam-policy PROJECT --format=json | jq '.auditConfigs'

# Create sink
gcloud logging sinks create SINK_NAME DESTINATION --log-filter='logName="projects/PROJECT/logs/cloudaudit.googleapis.com"'
```

## Azure Monitor

```bash
# List activity log
az monitor activity-log list --start-time START --end-time END

# Diagnostic settings
az monitor diagnostic-settings list --resource RESOURCE_ID

# Log profiles
az monitor log-profiles list
```
