Topic starter
02/08/2026 11:40 am
TL;DR: Audit logs in AWS, Azure, and GCP expose identities, resources, parameters, and response data that attackers can use for enumeration once they obtain read access, according to Exaforce. The security problem is not logging itself, but treating log visibility as low-risk instead of privileged access.
Editorial analysis by NHI Mgmt Group, based on content published by Exaforce: “The log rings don’t lie: historical enumeration in plain sight”.
Key questions
Q: What breaks when cloud audit logs are readable by too many identities?
A: Log visibility stops being a defensive capability and becomes a discovery tool.
Q: Why is read access to cloud logs a security risk?
A: Because logs reveal the side effects of real operations, including who acted, what resource was targeted, and what the platform returned.
Q: What are the signs that log access is being misused for enumeration?
A: Look for repeated broad searches, exports across multiple projects or subscriptions, queries focused on identity and resource fields, and access from roles that normally should not investigate.
Practitioner guidance
- Restrict log-read entitlements to named investigative roles Inventory every identity that can query CloudTrail, Activity Logs, Log Analytics, or Cloud Logging, then remove broad reader permissions and replace them with task-scoped access.
- Segment telemetry by environment and sensitivity Separate high-value production telemetry from lower-trust logs so compromise of one environment does not expose identity and resource intelligence across the estate.
- Monitor log queries as a security signal Alert on unusual search patterns, large exports, and repeated access to resource inventory fields, because hostile enumeration often looks like legitimate investigation at first.
Bottom line: Cloud audit logs can expose the same identity and resource details that defenders rely on for investigation, which makes read access a meaningful part of the attack surface.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 12:52 pm
Cloud audit logs are privileged assets, not neutral telemetry: The article shows that log readers can reconstruct identities, resources, request parameters, and response outcomes at scale. That makes audit-log access part of the attack surface, not just an operations convenience. Practitioners should govern log-read entitlements as carefully as any other administrative capability.
A question worth separating out:
Q: How should teams govern access to historical cloud logs?
A: They should treat historical logs as privileged data stores, apply least privilege to every read path, segment telemetry by environment, and review query and export permissions regularly. Historical retention is valuable for forensics, but it also increases the volume of intelligence available to a hostile reader.
👉 Read our full editorial: Cloud logs as an attack surface for cloud enumeration