Cloud security monitoring means detecting threats in cloud environments, where traditional network boundaries no longer apply. This is Module 15 of The Complete Blue Team Course.
The Shared Responsibility Model
Cloud providers secure the underlying infrastructure. You secure what you configure on top of it: identity, storage permissions, and network rules. Most cloud breaches trace back to a misconfiguration on the customer’s side of that line, not a failure of the provider.
Identity Is the New Perimeter
In the cloud there is often no traditional network perimeter. Who can assume which role and which permissions a service account holds is the control plane that matters most. That is why auditing identity and access management (IAM) is a central blue team skill in cloud-heavy environments.
Logging Across AWS, Azure, and GCP
- AWS: CloudTrail records API activity.
- Azure: Activity Logs and Entra ID sign-in logs.
- GCP: Cloud Audit Logs.
Centralizing these and alerting on privilege changes and unusual API calls is as important as any endpoint log.
High-Value Alerts to Start With
- Root or global admin sign-ins.
- New access keys or role assignments.
- Logging disabled or changed.
- Storage buckets made public.
Key Takeaways
- You are responsible for your configuration.
- Identity and permissions are the main attack surface.
- Enable and centralize control-plane logs from day one.
Frequently Asked Questions
What is CloudTrail?
AWS CloudTrail records API calls and account activity, making it the main audit log in AWS.
Where should I start learning cloud security?
Create a free-tier account in one cloud, enable audit logging, and practice reading the events.
Get the Full Blue Team Course
This is a free preview of Module 15. The complete 22-module course, from SOC fundamentals and SIEM to threat hunting, incident response, detection engineering, and career paths, is available as a one-time $1 download.