Comparison
Break-glass accessvsControl plane audit log
Break-glass access
there is a sealed credential that bypasses every control, its use pages three people, and it has been used twice.
A deliberately preserved emergency path to full access for when the normal ones fail — the identity provider is down, the automation is broken, the on-call cannot get in. It has to exist, because a control with no override becomes an outage of its own, and it must be loud: heavily audited, alerting on use, and rotated afterwards. It also needs testing, since an emergency path that depends on the system that is down is not one.
Full entry →Control plane audit log
every change request to the platform is recorded with who made it and what it was, in a place they cannot edit.
The record of every request made to the infrastructure API — who, what, when, allowed or denied. It is the primary evidence for both incidents and compliance, and it is only useful if it is retained outside the account it describes, since an attacker with control of the account can otherwise turn it off. Denied requests are the underrated half: a burst of them is one of the clearest signals of a compromised credential being explored.
Full entry →