Skip to content
Cloud Provider Benchmarks

Cloud security & auditing

AWS CloudTrail alternatives: audit logging on other clouds and OpenStack

CloudTrail's equivalents on Google Cloud, Azure, OpenStack-based clouds and smaller providers, compared on scope, identity, retention, export and integrity.

Published: Updated: Türkçe oku

Direct answer

The alternative to CloudTrail is the audit service of the cloud you actually use: Cloud Audit Logs on Google Cloud, the Activity Log on Azure, vTrail on PortvMind Cloud. For several providers at once, export each provider's events into a SIEM using a common schema.

Executive summary

CloudTrail is tied to AWS: it records AWS API activity and nothing else. When workloads run on another cloud, the equivalent is that provider's own audit service — Google Cloud Audit Logs, the Azure Activity Log, or vTrail on PortvMind Cloud — and for multi-cloud estates a SIEM or log platform that normalises them. Among smaller providers, public documentation of audit logging is uneven, and for several tracked providers a control-plane audit log could not be verified.

Key findings

  1. 01 Audit logs are provider-specific because only the provider sees every API request; third-party tools consume these logs rather than replace them.
  2. 02 Google Cloud Audit Logs and the Azure Activity Log match CloudTrail's core model of default control-plane logging with optional data-access logs and export.
  3. 03 For DigitalOcean, Vultr and Hetzner, a customer-facing control-plane audit log is marked unverified in this site's data because no sufficient public documentation was found.
  4. 04 Field mappings between formats are close for identity, time, source IP and operation, and diverge for request latency and gateway routing data.

Why there is no drop-in replacement

An audit log must see every API request with the identity that made it. Only the platform that authenticates and serves those requests has that view. So the alternative to CloudTrail is never a separate product running beside your cloud — it is the audit service built into the cloud you use.

Equivalents by provider

Provider Audit service Default scope
AWS CloudTrail Management events; data events opt-in
Google Cloud Cloud Audit Logs Admin Activity always on; Data Access mostly opt-in
Microsoft Azure Activity Log Subscription control plane; data plane via resource logs
PortvMind Cloud vTrail Management API operations (provider-supplied)
Documented features of cloud audit logging services
Feature vTrail PortvMind Cloud AWS CloudTrail Amazon Web Services Azure Monitor Activity Log Microsoft Azure Cloud Audit Logs Google Cloud
Control-plane audit scope Records management operations (create, modify, delete) performed through the API or console. Yes Cloud management API operations. Yes Management events recorded by default. Yes Azure Resource Manager write/delete/action operations. Yes Admin Activity logs always enabled.
Identity attribution Identifies the authenticated user, project/account and scope behind each operation. Yes User ID, user name, project ID and auth scope. Yes userIdentity block (principal, account, session). Yes Caller and claims. Yes authenticationInfo.principalEmail.
Request metadata Captures request ID, HTTP method, path, status code, source IP and user agent. Yes Request ID, HTTP method, path, status, client IP, user agent, request time. Yes eventTime, requestID, sourceIPAddress, userAgent, errorCode. Partial Correlation ID, operation, status and caller IP in HTTP request details where available. Yes requestMetadata.callerIp and callerSuppliedUserAgent; status.
Data-plane (data access) events Optional recording of data-level reads and writes (for example object reads). Unverified Yes Data events (for example S3 object-level) are optional and charged. Partial Via resource logs and diagnostic settings, not the Activity Log itself. Yes Data Access logs, mostly disabled by default.
Event search and filtering Console or API search by user, time range, resource or operation. Unverified Yes Event history lookup; SQL queries in CloudTrail Lake. Yes Portal filtering and Log Analytics (KQL). Yes Logs Explorer and Log Analytics.
Configurable retention Documented default retention and options to extend it. Unverified Yes 90-day event history; longer retention via trails to S3 or CloudTrail Lake. Yes 90 days in the platform; longer through Log Analytics or Storage. Yes Admin Activity retained 400 days in _Required; other buckets configurable.
Export and streaming Delivery to object storage, log analytics or SIEM pipelines. Unverified Yes S3, CloudWatch Logs, EventBridge. Yes Diagnostic settings to Log Analytics, Storage and Event Hubs. Yes Sinks to Cloud Storage, BigQuery and Pub/Sub.
Log integrity validation Cryptographic or immutability controls that detect tampering. Unverified Yes Log file integrity validation with digest files. Partial Immutable storage policies on the export destination. Partial Locked log buckets prevent retention changes.
Pricing model Whether baseline audit history is included and how extended capabilities are charged. Unverified Yes Event history and one copy of management events free; data events and Lake charged. Yes 90-day Activity Log included; ingestion into Log Analytics is charged. Yes Admin Activity at no charge; Data Access ingestion charged beyond free allotment.
Information source Supplied by provider team Official documentation Official documentation Official documentation

Smaller providers

Audit-logging documentation among smaller providers is uneven. In this site’s capability data, a customer-facing control-plane audit log is marked unverified for DigitalOcean, Vultr and Hetzner. “Unverified” means no public documentation sufficient to confirm the feature was found; the value will change as documentation is published.

Audit capabilities across tracked providers
Criterion PortvMind AWS Azure Google Cloud DigitalOcean Vultr Hetzner
Security & auditing
Control-plane audit logging A provider service that records management (API/console) operations against cloud resources. Yes vTrail (provider-supplied capability information). Yes AWS CloudTrail. Yes Azure Monitor Activity Log. Yes Cloud Audit Logs. Unverified Unverified Unverified
User identity attribution in audit events Each audit event identifies the authenticated principal that performed the operation. Yes vTrail records the authenticated user, project and scope (provider-supplied). Yes Yes Yes Unverified Unverified Unverified

Field mapping

When consolidating several providers, map each event format to a common schema. The table below shows conceptual equivalents for the fields in vTrail’s event model.

Conceptual cloud audit event data model For research documentation; does not represent production audit records.
Field Type Description AWS CloudTrail Google Cloud Audit Logs OpenStack CADF
event_time string (RFC 3339) When the operation was received, in UTC. eventTime timestamp eventTime
request_id string Unique request identifier used to correlate gateway, service and resource logs. requestID insertId / operation.id id / requestId (attachment)
http_method string HTTP verb of the API call (GET, POST, PUT, PATCH, DELETE). — httpRequest.requestMethod action (mapped)
full_path string Requested API path, identifying the target resource. eventSource + eventName protoPayload.methodName / resourceName target.id / requestPath
http_status integer Response status code — the outcome of the operation. errorCode (on failure) protoPayload.status.code outcome / reason.reasonCode
client_ip string (IP) Source IP address of the caller. sourceIPAddress protoPayload.requestMetadata.callerIp initiator.host.address
user_agent string Client software (console, CLI, SDK, Terraform). userAgent protoPayload.requestMetadata.callerSuppliedUserAgent initiator.host.agent
auth_user_id string Stable identifier of the authenticated user. userIdentity.principalId protoPayload.authenticationInfo.principalSubject initiator.id
auth_user_name string Human-readable user name at the time of the request. userIdentity.userName / arn protoPayload.authenticationInfo.principalEmail initiator.name
auth_project_id string Project (tenant) the token was scoped to. recipientAccountId resource.labels.project_id initiator.project_id
auth_scope string Authorisation scope or role context of the token. userIdentity.sessionContext protoPayload.authorizationInfo initiator.credential
service_id string Backend cloud service that handled the request (compute, network, storage). eventSource protoPayload.serviceName observer.id / target.typeURI
route_id string API gateway route that matched the request. — — —
request_time number (ms) End-to-end request processing time. — httpRequest.latency —
Empty template (JSON)
{
  "event_time": "",
  "request_id": "",
  "http_method": "",
  "full_path": "",
  "http_status": null,
  "client_ip": "",
  "user_agent": "",
  "auth_user_id": "",
  "auth_user_name": "",
  "auth_project_id": "",
  "auth_scope": "",
  "service_id": "",
  "route_id": "",
  "request_time": null
}

Multi-cloud consolidation

  • Export each provider’s events to a central log platform or SIEM.
  • Normalise to a shared schema (CADF, OCSF or an internal model).
  • Keep the original record alongside the normalised one for investigations.
  • Alert on logging-configuration changes in every provider.

Limitations

Assessments are documentation-based and follow the cloud auditing methodology. vTrail information is provider-supplied.

Conclusion

Choosing a CloudTrail alternative is really choosing a cloud. When evaluating a provider, ask whether its audit service records identity-attributed control-plane activity, how long it keeps it, and how you can export it.

Frequently asked questions

Can CloudTrail log activity on another cloud?

No. CloudTrail records AWS API calls. CloudTrail Lake can ingest external events, but those events must be produced by the other platform's own audit source.

What is the CloudTrail equivalent on Azure?

The Azure Activity Log for subscription-level control-plane operations, complemented by resource logs for data-plane activity.

What is the CloudTrail equivalent on Google Cloud?

Cloud Audit Logs, specifically Admin Activity logs for control-plane operations and Data Access logs for data reads and writes.

Sources

  1. [1] AWS CloudTrail User Guide — AWS Official documentation accessed:
  2. [2] Cloud Audit Logs overview — Google Cloud Official documentation accessed:
  3. [3] Azure Monitor activity log — Microsoft Official documentation accessed:
  4. [4] keystonemiddleware — Audit middleware — OpenStack Official documentation accessed:
  5. [5] PortvMind Cloud — PortvMind Supplied by provider team accessed: