Audit Logs Access and Accountability

[All Actors]
1. Apply least-privilege access control, e.g., role- or attribute-based (RBAC/ABAC) to every audit-log store, service and API.

2. Require unique user identities and strong authentication (e.g., MFA) for all log-access requests.

3. Record every read, write, delete or configuration event on audit logs, capturing user ID, source, timestamp and action.

4. Store logs in tamper-evident or immutable locations and replicate for durability.

5. Monitor access patterns and generate real-time alerts for unauthorised attempts, privilege escalation or anomalous activity.

6. Review and reconcile log-access permissions regularly, on a risk-based schedule and revoke any unnecessary rights.

7. Retain log-access records for the policy-defined period and make them available for audit, forensics and compliance reporting.

1. Inquiring with Control Owners

1.1 Conduct interviews with personnel responsible for managing cloud infrastructure audit log access controls and maintaining access records to understand their authorization processes for accessing infrastructure logs, customer workload logs, and system security events. Verify their understanding of access restriction mechanisms and record-keeping requirements for all cloud infrastructure audit log access activities.

2. Inspecting Records and Documents

2.1 Verify access to cloud infrastructure-generated audit logs (including compute resource usage, customer workload events, infrastructure security incidents, and system operations) is restricted to authorized personnel.

2.2 Ensure cloud infrastructure logging access is role-based and mapped to least privilege principles, maintaining customer workload isolation and data protection.

2.3 Confirm all cloud infrastructure log access events are themselves logged with timestamps, actor IDs, and specific customer environment data accessed.

2.4 Check for formal review processes of cloud infrastructure log access permissions, including customer data isolation requirements.

2.5 Validate cloud operations and infrastructure teams are not granted persistent access to customer-specific logs without approval and operational necessity.

2.6 Review incident records for unauthorized access to cloud infrastructure audit logs and follow-up actions taken.

2.7 Confirm procedures are in place to revoke cloud infrastructure log access upon role changes or terminations.

2.8 Examine documented access control policies and procedures for cloud infrastructure audit log systems, including customer tenant protections.

2.9 Validate that cloud infrastructure access records are retained according to customer SLAs and compliance requirements.

2.10 Review monitoring and alerting mechanisms for unauthorized or suspicious cloud infrastructure audit log access attempts.

2.11 Ensure CSP-native audit logs (e.g., CloudTrail, Stackdriver, Activity Logs) are accessible only to authorized roles.

2.12 Confirm administrative access to audit logs is gated through MFA and approval workflows.

2.13 Validate log access events are included in centralized security monitoring dashboards.

2.14 Review segregation of duties policies to prevent log tampering or unauthorized deletions.

2.15 Check that tenant-specific log access is isolated and auditable per customer.

2.16 Verify CSP performs and documents periodic access reviews of logging infrastructure.