Comparison
Control plane audit logvsStructured logging
Control plane audit log
every change request to the platform is recorded with who made it and what it was, in a place they cannot edit.
The record of every request made to the infrastructure API — who, what, when, allowed or denied. It is the primary evidence for both incidents and compliance, and it is only useful if it is retained outside the account it describes, since an attacker with control of the account can otherwise turn it off. Denied requests are the underrated half: a burst of them is one of the clearest signals of a compromised credential being explored.
Full entry →Structured logging
you log an object with named fields instead of a sentence, so you can query on user id rather than grep for it.
Emitting logs as machine-parseable records with consistent field names. It turns logs into something queryable and aggregatable rather than something you read. The discipline is in the field names: a user id logged under four different keys is four fields that cannot be joined.
Full entry →