Comparison
Audit trailvsControl plane audit log
Audit trail
somebody asks who read the salary table last March and you can answer with a query rather than with a guess.
The retained record of who accessed or changed what, and when. In a warehouse it is unusually cheap to have, because the query history exists anyway, and unusually valuable during an incident or an investigation. It also doubles as the input to deprecation decisions and cost attribution, which is generally what gets it turned on before any regulator asks.
Full entry →Control plane audit log
every change request to the platform is recorded with who made it and what it was, in a place they cannot edit.
The record of every request made to the infrastructure API — who, what, when, allowed or denied. It is the primary evidence for both incidents and compliance, and it is only useful if it is retained outside the account it describes, since an attacker with control of the account can otherwise turn it off. Denied requests are the underrated half: a burst of them is one of the clearest signals of a compromised credential being explored.
Full entry →