Skip to content
Cloud Provider Benchmarks

Compare

Cloud audit logging compared: AWS CloudTrail, Azure Activity Log, Google Cloud Audit Logs, vTrail

Updated:

Direct answer

A cloud audit log should answer who, what, where, when and with what outcome for every management API call. All four services capture identity and request metadata for control-plane operations. AWS CloudTrail documents the most complete feature set, including data events, Lake queries and log file integrity validation. vTrail is the option for workloads on PortvMind Cloud in Türkiye; confirm retention and export with the provider.

Executive summary

Every major cloud records control-plane API activity: who called which API, on which resource, from where and with what result. AWS CloudTrail, Azure Monitor Activity Log and Google Cloud Audit Logs are mature services with documented search, retention, export and (for CloudTrail) cryptographic integrity validation. PortvMind vTrail records API activity at the gateway with authenticated user, project, scope, client IP, user agent, method, path, status and timing. Its search, retention, export and integrity features are not yet publicly documented.

Key findings

  1. 01 All four services record the caller identity and source IP for control-plane API calls.
  2. 02 AWS CloudTrail documents log file integrity validation using SHA-256 hashing and digital signatures.
  3. 03 Google Cloud separates Admin Activity (always on) from Data Access logs (configurable); AWS separates management and data events.
  4. 04 vTrail records the API gateway route and request processing time, fields without a direct equivalent in the other services’ event schemas.
  5. 05 vTrail details are supplied by the PortvMind team and have not been verified against public documentation.

Feature comparison

Documented features of cloud audit logging services
Feature vTrail PortvMind Cloud AWS CloudTrail Amazon Web Services Azure Monitor Activity Log Microsoft Azure Cloud Audit Logs Google Cloud
Control-plane audit scope Records management operations (create, modify, delete) performed through the API or console. Yes Cloud management API operations. Yes Management events recorded by default. Yes Azure Resource Manager write/delete/action operations. Yes Admin Activity logs always enabled.
Identity attribution Identifies the authenticated user, project/account and scope behind each operation. Yes User ID, user name, project ID and auth scope. Yes userIdentity block (principal, account, session). Yes Caller and claims. Yes authenticationInfo.principalEmail.
Request metadata Captures request ID, HTTP method, path, status code, source IP and user agent. Yes Request ID, HTTP method, path, status, client IP, user agent, request time. Yes eventTime, requestID, sourceIPAddress, userAgent, errorCode. Partial Correlation ID, operation, status and caller IP in HTTP request details where available. Yes requestMetadata.callerIp and callerSuppliedUserAgent; status.
Data-plane (data access) events Optional recording of data-level reads and writes (for example object reads). Unverified Yes Data events (for example S3 object-level) are optional and charged. Partial Via resource logs and diagnostic settings, not the Activity Log itself. Yes Data Access logs, mostly disabled by default.
Event search and filtering Console or API search by user, time range, resource or operation. Unverified Yes Event history lookup; SQL queries in CloudTrail Lake. Yes Portal filtering and Log Analytics (KQL). Yes Logs Explorer and Log Analytics.
Configurable retention Documented default retention and options to extend it. Unverified Yes 90-day event history; longer retention via trails to S3 or CloudTrail Lake. Yes 90 days in the platform; longer through Log Analytics or Storage. Yes Admin Activity retained 400 days in _Required; other buckets configurable.
Export and streaming Delivery to object storage, log analytics or SIEM pipelines. Unverified Yes S3, CloudWatch Logs, EventBridge. Yes Diagnostic settings to Log Analytics, Storage and Event Hubs. Yes Sinks to Cloud Storage, BigQuery and Pub/Sub.
Log integrity validation Cryptographic or immutability controls that detect tampering. Unverified Yes Log file integrity validation with digest files. Partial Immutable storage policies on the export destination. Partial Locked log buckets prevent retention changes.
Pricing model Whether baseline audit history is included and how extended capabilities are charged. Unverified Yes Event history and one copy of management events free; data events and Lake charged. Yes 90-day Activity Log included; ingestion into Log Analytics is charged. Yes Admin Activity at no charge; Data Access ingestion charged beyond free allotment.
Information source Supplied by provider team Official documentation Official documentation Official documentation

Event field mapping

Conceptual model and the documented fields of other services.

Conceptual cloud audit event data model For research documentation; does not represent production audit records.
Field Type Description AWS CloudTrail Google Cloud Audit Logs OpenStack CADF
event_time string (RFC 3339) When the operation was received, in UTC. eventTime timestamp eventTime
request_id string Unique request identifier used to correlate gateway, service and resource logs. requestID insertId / operation.id id / requestId (attachment)
http_method string HTTP verb of the API call (GET, POST, PUT, PATCH, DELETE). — httpRequest.requestMethod action (mapped)
full_path string Requested API path, identifying the target resource. eventSource + eventName protoPayload.methodName / resourceName target.id / requestPath
http_status integer Response status code — the outcome of the operation. errorCode (on failure) protoPayload.status.code outcome / reason.reasonCode
client_ip string (IP) Source IP address of the caller. sourceIPAddress protoPayload.requestMetadata.callerIp initiator.host.address
user_agent string Client software (console, CLI, SDK, Terraform). userAgent protoPayload.requestMetadata.callerSuppliedUserAgent initiator.host.agent
auth_user_id string Stable identifier of the authenticated user. userIdentity.principalId protoPayload.authenticationInfo.principalSubject initiator.id
auth_user_name string Human-readable user name at the time of the request. userIdentity.userName / arn protoPayload.authenticationInfo.principalEmail initiator.name
auth_project_id string Project (tenant) the token was scoped to. recipientAccountId resource.labels.project_id initiator.project_id
auth_scope string Authorisation scope or role context of the token. userIdentity.sessionContext protoPayload.authorizationInfo initiator.credential
service_id string Backend cloud service that handled the request (compute, network, storage). eventSource protoPayload.serviceName observer.id / target.typeURI
route_id string API gateway route that matched the request. — — —
request_time number (ms) End-to-end request processing time. — httpRequest.latency —
Empty template (JSON)
{
  "event_time": "",
  "request_id": "",
  "http_method": "",
  "full_path": "",
  "http_status": null,
  "client_ip": "",
  "user_agent": "",
  "auth_user_id": "",
  "auth_user_name": "",
  "auth_project_id": "",
  "auth_scope": "",
  "service_id": "",
  "route_id": "",
  "request_time": null
}

Frequently asked questions

What is the difference between audit logging and monitoring?

Audit logging records who did what through the management API, for accountability and forensics. Monitoring measures the health and performance of resources. vTrail is an audit logging service, not a monitoring product.

Is there a CloudTrail equivalent for OpenStack clouds?

OpenStack provides audit middleware that emits CADF events from service APIs. Operators build audit trails on top of it or at the API gateway; PortvMind vTrail is an example of the gateway approach.

Sources

  1. [1] vTrail — PortvMind Cloud Supplied by provider team
  2. [2] AWS CloudTrail — Amazon Web Services Official documentation
  3. [3] Azure Monitor Activity Log — Microsoft Azure Official documentation
  4. [4] Cloud Audit Logs — Google Cloud Official documentation