Data-Plane Log
Definition
A record of operations on the data inside a resource: S3 object reads, KMS decrypts, database queries. Off by default in most services and the single biggest gap in cloud cases.
- Records
- Operations on data: object reads, decrypts, queries
- Default state
- Off in most cloud services
- Contrast
- Control-plane logs record admin/API actions
- Investigative significance
- Largest evidentiary gap in cloud cases
Common questions
Why is the absence of data-plane logging such a significant obstacle in cloud incident response?+
Control-plane logs like AWS CloudTrail management events capture who created or modified a resource, but without data-plane logging enabled in advance, investigators cannot see which specific objects a compromised account actually read or exfiltrated, leaving a gap between confirming access occurred and proving what data was taken.
What can an investigator do when data-plane logs were never enabled before an incident?+
They must rely on indirect evidence such as network egress volume, application-layer logs, billing anomalies from API call volume, or object versioning timestamps to infer what was likely accessed, since data-plane logs cannot be retroactively generated for events before logging was turned on.
Related terms
- CERT-in Direction April 2022
- Direction issued under Section 70B(6) of the IT Act 2000 requiring 6-hour incident reporting, 180-day log retention in India, KYC retention by...
- Control-Plane Log
- A record of management API calls against cloud resources (create, delete, modify, attach IAM role). AWS CloudTrail, Azure Activity Log, and GCP...
- Forensic Account
- A dedicated cloud account, separate from the production account, that holds shared snapshots, the forensic analysis instance, and the chain-of-custody artefacts. Isolating...
- Service Control Policy
- An AWS Organizations policy attached to an account or OU that constrains what IAM principals inside the account can do. Used in...
- VM Snapshot
- A point-in-time copy of a managed disk taken at the storage layer (EBS, Azure managed disk, GCP persistent disk). Crash-consistent by default;...