Control plane audit log

The record of every request made to the infrastructure API — who, what, when, allowed or denied. It is the primary evidence for both incidents and compliance, and it is only useful if it is retained outside the account it describes, since an attacker with control of the account can otherwise turn it off. Denied requests are the underrated half: a burst of them is one of the clearest signals of a compromised credential being explored.