Control-Plane Log
Definition
A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP Admin Activity logs are the canonical examples.
- Examples
- AWS CloudTrail, Azure Activity Log, GCP Admin Activity
- Records
- Management API calls on cloud resources
- Example actions
- Create, delete, modify, attach IAM role
Common questions
How does a control-plane log differ from a data-plane log?+
A control-plane log records administrative actions that change or configure resources, while a data-plane log records actual access to the data held within those resources, such as file reads.
Why is control-plane logging especially important in cloud incident response?+
It often shows the attacker manipulating infrastructure itself, such as creating a new privileged role or disabling logging, which can be the earliest and clearest sign of a compromise.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Data-Plane Log
- A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most...
- Forensic Account
- A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating...
- Service Control Policy
- An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...