In the cloud, the control plane is where configuration becomes reality. Audit logs reveal who changed it, from where and with what identity.
Control plane versus data plane
- Control plane: creating roles, changing policies, starting instances, modifying buckets.
- Data plane: reading objects, querying a database, invoking a function.
A stolen key may read data without changing configuration, so you need both. Control-plane logs are usually the first place to investigate persistence and privilege changes.
What to log
- identity sign-ins and MFA changes;
- role and policy changes;
- access key creation;
- security group and network changes;
- storage policy and public-access changes;
- logging configuration changes (especially disabling it).
Continue this lesson in the player
A free account unlocks the full lesson, the five-question knowledge check, progress tracking, notes and the completion certificate.