When Your Audit Logs Show Keys but Not Who Used Them – and How to Fix It

So you pull the audit logs for a sensitive key—maybe a KMS encryption key or a service account credential. You see a flurry of Decrypt calls, timestamps, maybe a source IP that belongs to your cloud provider's internal network. But who made those calls? A user? A script? Another service? The log says user: anonymous or principal: unknown. Or it shows the key's ARN but not the caller's role ARN. You're stuck. This isn't a rare corner case. It's the default behavior for many key usage patterns in multi-cloud setups, especially when workloads run on Kubernetes, Lambda, or auto-scaled VMs. The identity gets abstracted away. The key gets used, but the audit trail dead-ends.

Where This Bites You in Real Work

Real incident: a decryption spike with no user attribution

We got the alert at 3:14 AM. CloudTrail showed a single key—let's call it prod-pay-cust-03—being used to decrypt roughly 10,000 records between 02:47 and 02:52. The log entry was pristine: API call KMS:Decrypt, source IP within the VPC, request ID, key ARN. One field was blank: userIdentity.arn. Not 'root'. Not a role session. Null. The security engineer on call had two choices: wake the database group to check query patterns, or assume an attacker had burned a stolen key in five minutes flat. Neither option ends well. That incident expense us a full incident-response cycle—four people, six hours—only to discover a CI/CD pipeline had rotated a secret and the new service account lacked the IAM policy to log identity correctly. The key worked. The logs lied.

The tricky part is that cloud providers log key usage faithfully. They don't log who used it unless the caller sends the right metadata. AWS KMS, for example, omits the caller identity when requests come through a VPC endpoint with a misconfigured endpoint policy—or when the caller uses the key via an alias that bypasses key-policy evaluation. Azure Key Vault logs the vault name and operation; the calling principal is often hidden behind managed identity tokens that resolve to 'System Assigned'—unhelpful for attribution. GCP Cloud Audit Logs? Same story: if the key is accessed via a service account impersonation chain, you see the last hop, not the original actor.

Common scenarios: CI/CD pipelines, ephemeral containers, cross-account access

I have seen this pattern in production at least a dozen times. A CI/CD pipeline fetches a decryption key during deployment. The pipeline uses a role that assumes another role that fetches a token that calls KMS. The audit log shows the delegated role. Not the pipeline ID. Not the committer. Not the branch. Just a role ARN that three different pipelines share. When something goes wrong—say a pull request from a forked repo triggers decryption of staging secrets—you can't tell which PR or which engineer triggered it. The security group freezes deployments for two days. The engineering group reverts to static keys. That hurts.

Ephemeral containers make it worse. A Kubernetes pod spins up, decrypts a secret for the application config, then dies. The audit log shows the pod's node-instance role. Next week, during an audit, the compliance officer asks: "Which workload accessed the PCI key at 14:32?" You check the logs: the node role accessed it 2,000 times that hour across 400 pods. Zero attribution. Compliance crews panic when logs show 'unknown' for a key used to decrypt 10,000 records—I have watched a CISO cancel a cloud migration over exactly this gap. Cross-account access adds the final twist: a central security account owns the key, but three business units access it via resource-based policies. The audit log shows the external account ID—not the user, not the role name, not the reason. Just a number. Wrong order.

Why compliance groups panic when logs show 'unknown'

The catch is that regulatory frameworks—SOC 2, PCI DSS, ISO 27001—require individual accountability for cryptographic operations. 'Unknown' is not a person. It's not a system. It's a gap that auditors flag as a finding, and once flagged, you have 30 days to fix it or lose certification. I have seen units burn two sprints piping CloudTrail into a custom attribution layer, only to discover that the missing identity was structurally unrecoverable—the key was used with a client SDK that stripped the caller context before sending the API request. That's a design flaw, not a logging gap.

'Show me which human or which pipeline run decrypted that record—if your logs can't, your control is imaginary.'

— Compliance lead, post-mortem for a failed SOC 2 renewal

What usually breaks primary is the incident response runbook. When every decryption spike looks like a breach, the group defaults to distrusting all logs. That's worse than missing logs—it erodes the entire monitoring culture. The fix is not more logging. The fix is ensuring every key access carries an identity token that survives abstraction layers. We fixed this by adding a required encryption-context field that forced callers to include a pipeline-run ID. The logs then showed encryptionContext.ci_pipeline_run alongside the key usage. Not perfect attribution—but enough to distinguish the bad deploy from the legitimate one. Next experiment: enforce that every cross-account key policy requires a condition checking the caller's aws:PrincipalTag with the crew name. If the tag is missing, the key denies access. That shifts the burden upstream—where it belongs.

What Most People Get Wrong About Cloud Audit Logs

Cloud audit logs aren't surveillance cameras—they're event receipts

Most groups assume that enabling full logging across AWS CloudTrail, Azure Monitor, or GCP Audit Logs gives them a perfect replay of who did what with each cryptographic key. That assumption breaks within your primary real incident review. What you actually get is a timestamp, a key ID, a service name—and often a gap where the human or automated caller should be. The logs record that a thing happened to a key, not who asked for it. That distinction costs you hours during post-mortems.

The tricky part is understanding why the identity field goes missing. Cloud platforms split audit data into two planes. Control-plane logs (creating a key, rotating it, deleting it) almost always include the calling principal—an IAM user, a role ARN, a service account. These are the logs everyone checks initial. Data-plane logs (using the key to encrypt, decrypt, sign, or verify) frequently omit the caller entirely. Why? Because many key operations happen inside the infrastructure—a container reads a secret via the KMS API, a Lambda function calls Decrypt during cold start, a storage service uses a CMK for server-side encryption. In those cases, the caller is the service itself, not an end user. The log says “the KMS service called itself.” That's technically correct but operationally useless.

“We spent three days tracing a key usage spike. The logs showed the key was used 14,000 times—but every caller field read ‘AWS Internal.’ That’s not an audit trail, it’s a count.”

— Senior SRE, multi-cloud fintech deployment

Field note: data plans crack at handoff.

Field note: data plans crack at handoff.

Vendors, contractors, couriers, inspectors, dyers, embroiderers, and patternmakers hand off partial truth unless logs stay current.

Zinc quinoa glyph marks stock.

Overlock, chainstitch, lockstitch, zigzag, blindhem, and coverseam machines wear needles, looper hooks, and feed dogs at unlike intervals.

Zinc quinoa glyph marks stock.

The dangerous myth: ‘If we enable all logging, we see everything’

I have watched groups enable every possible logging toggle across three clouds—CloudTrail trail for management events, S3 data events, KMS key usage logging, Azure Diagnostics, GCP Data Access audit logs—and still come up empty when asked “Who decrypted the database credential key at 3:14 AM?”. The logs show the key was used. The source IP might belong to an internal CIDR block. The user agent says “boto3/1.26.73”. But the principal identity is a wildcard or a service-linked role shared by a hundred workloads. That's not a logging configuration problem—it's a design flaw in how you route key access.

Worth flagging—the misconception runs deeper than simple ignorance of data-plane versus control-plane. It's the belief that raw log volume equals visibility. You can generate terabytes of audit data and still have zero ability to attribute a single key operation to a human being or a specific application version. The logs record what the cloud provider knows, which is precious little about your internal orchestration. When your CI/CD pipeline uses a vault sidecar that retrieves keys via the Vault API, the cloud audit log only sees “someone called the vault service.” The actual identity—your build ID, the developer who triggered the pipeline, the tenant—lives in your vault's own audit trail, not in the cloud log.

What usually breaks opening is the trust in the log itself

groups double down by adding more logging: CloudTrail Insights, detailed billing tags on keys, custom metric filters. That just buries the missing identity problem under more noise. The real fix is not more logs—it's changing where and how you capture identity before the operation reaches the cloud KMS. Most people get this wrong because they treat audit logs as a complete record rather than a piece of a larger chain. The cloud log is the last link—it says “key X was used.” The primary link—who authenticated to the proxy, which session token was used, what policy evaluated—must be stitched together from a different system. Start treating cloud audit logs as evidence of what, not who. Then build your identity mapping upstream, before the request hits the KMS API. That shift—from log enrichment to pre-operation identity injection—is the difference between a log that incriminates and a log that only counts.

Patterns That Actually Give You the Identity

Using VPC endpoints to force source identity into logs

The cleanest fix I have seen starts before the API call ever reaches KMS. A VPC endpoint for KMS—properly configured with a bucket policy or endpoint policy—can strip anonymous access and demand a principal ARN. That sounds trivial until you realize most multi-cloud crews deploy KMS through a shared service VPC and never lock down the endpoint. The trick is writing a policy that rejects any action unless aws:SourceVpce matches a specific endpoint AND the caller’s role is logged in CloudTrail. We fixed this for a client whose logs showed 14,000 decrypt calls from “an unknown IAM user” every Tuesday. Turned out a Lambda in a different account was using an outdated role that inherited full access. The endpoint policy caught it within two hours—the logs finally showed the actual Lambda execution role.

Enabling data-plane logging for KMS

CloudTrail management events alone are a trap. They log that a key was used—but not who sent the request payload. Data-plane logging (often called “data events” in AWS or “customer-managed key audit” in GCP) captures each individual API operation on the key itself. Enable it. But here is the pitfall: data-plane logs can explode in volume. One group I worked with saw their logging bill jump 40% in a month because they had not filtered by key ARN or excluded read-only operations. The pattern that works: enable data-plane logging only for keys that handle sensitive data, and set a lifecycle rule to expire logs after 90 days. You get the caller identity—Lambda function name, EC2 instance ID, or OIDC provider—without drowning in noise. Most units skip this filter, then revert when the bill arrives. That hurts.

Mapping workload identities via OIDC and attribute-based access control

The deepest pattern moves identity out of static IAM roles and into the request itself. When a workload uses OIDC federation—say, a Kubernetes pod assuming an AWS role through IRSA—the pod’s service account token carries a sub claim. If you log that claim alongside the KMS action, you suddenly know which microservice, namespace, and environment called the key. Attribute-based access control (ABAC) codifies this: the policy conditions on aws:PrincipalTag/namespace or gcp:ResourceLabel. One security engineer told me, “Before ABAC, my audit logs were a black box of role ARNs. After, I could grep for staging and see exactly which cron job leaked the key.” The catch? Not every cloud provider logs OIDC claims in KMS audit trails by default. You have to pipe those claims through a custom log entry or use a sidecar proxy. Worth flagging—this adds latency and a moving part. But the identity clarity is unmatched.

“The moment logs show a pod name instead of a role ARN, your incident response window drops from hours to minutes.”

— senior cloud architect, after migrating 200 services to IRSA

The pattern that actually holds up in production is the one that couples endpoint enforcement with data-plane logging and ABAC tagging. Pick the low-hanging fruit primary—VPC endpoint policies—then layer in data-plane event filtering. Skip OIDC mapping until you have a single namespace that causes the most audit confusion. That's the experiment to run next Tuesday: take one key, enable data-plane logging, and see whether you finally see the caller identity you have been missing. If not, the endpoint policy is misconfigured. Fix that before touching anything else.

Quick Fixes That Backfire (and Why groups Revert)

Over-Auditing Every Key Operation: spend and Noise Explode

You can be forgiven for thinking 'if a little logging is good, more must be better.' groups often flip every possible flag — logging every Decrypt, every GenerateDataKey, even failed attempts — only to watch the bill triple in a week. Worse, the signal-to-noise ratio collapses. I have seen an engineer spend two days grepping through 400,000 log lines to find a single rogue key rotation. The tricky part is that cloud providers charge per event ingested and per gigabyte stored. That flood of 'useful' data becomes a expense center nobody wants to own. And when the finance staff asks why the observability budget jumped 40%, the initial thing to go is the verbose logging config. groups revert because the noise made the dashboard useless — they couldn't spot the one real incident in the stream of benign key refreshes.

The catch is that some operations are critical to log. But most units skip the step of classifying key actions into 'investigation-relevant' vs. 'operational hum.' Rotating a key every 90 days? Log the rotation event, not the 15,000 decryption calls that key served. Over-auditing doesn't just spend money — it buries the evidence you actually need.

Adding Custom Logging Agents That Miss Events or Break

Another quick fix: drop a custom sidecar or Lambda function that intercepts every KMS Encrypt call and enriches it with identity metadata. This sounds precise. But custom agents introduce two failure modes. primary, they miss events — often silently. A race condition in the sidecar startup means the opening 200 requests after a deployment bypass enrichment. Second, they break under load. We fixed this for a crew whose agent crashed during a flash sale; they lost 12 hours of audit data during a suspected key leak. Worth flagging—the agent itself becomes a compliance liability. If it fails and you don't notice, your logs now contain gaps that look like intentional deletion. That's a bad conversation with an auditor. Most crews revert because maintaining the agent across three cloud providers (AWS, GCP, Azure) is a full-slot job nobody budgeted for.

Flag this for data: shortcuts overhead a day.

Flag this for data: shortcuts spend a day.

Woven, knit, jersey, denim, twill, satin, mesh, and interfacing behave differently when needles heat up mid-batch.

Serac crevasse bridges rewrite courage.

Fly-tying vises, hackle pliers, dubbing wax, leader formulas, and tippet rings turn rivers into workshops.

Serac crevasse bridges rewrite courage.

Patching Logs Post-Hoc With Correlation That Fails Under Load

The most seductive anti-pattern: keep your sparse cloud logs, but join them against an application request log after the fact. "We'll just correlate by timestamp and resource ARN." That sounds clean until you hit a production incident. Under load, timestamps drift across systems — your app log says 10:00:02.347, the cloud audit log says 10:00:02.000. The join misses 15% of entries. I have watched a team spend three sprints building a correlation pipeline, only to abandon it when they realized the false-positive rate for identity attribution was 23%.

'We had the key action, but we matched it to the wrong user — and shipped a false security alert to the CISO.'

— Engineering lead, after rolling back their correlation layer

The root issue is that cloud audit logs weren't designed for high-cardinality joins under latency constraints. They're eventually consistent. By the slot you correlate, the session that used the key may have expired. groups revert because the correlation logic becomes a fragile web of phase-window tolerances and retry logic — and it still breaks on the initial real spike in traffic. A better experiment: push the identity binding into the key material itself (via key metadata or tags that survive rotation) rather than trying to stitch it together after the fact. That's the next frontier — but don't try to fix the logs by piling more logs on top. That just doubles the headache.

The Hidden expense of Keeping Identity in Logs

Storage and Query spend for High-Volume Decryption Logs

The opening slot you run a spend attribution report on your logging infrastructure, the number will stop you cold. I’ve watched units who proudly enabled full identity tracking on every Decrypt and GenerateDataKey call—only to discover that eighty percent of those logs are never read. Ever. But you’re paying for them monthly. Cloud providers charge by ingestion volume, by storage tier, and by the query you fire when the compliance team asks “who accessed the payment pipeline last Tuesday?” That query scans terabytes of noise to find one answer. The math stings: a single microservice rotating keys once per minute generates roughly 43,000 log entries a month. Multiply by five environments, three regions, and suddenly your ‘audit trail’ is a line item larger than the compute that produced it. Most groups skip this spend projection. The catch is—the spend doesn’t stay flat. It compounds as you add workloads.

Latency Impact When Every Key Operation Waits for Additional Auditing

You don’t notice the 50-millisecond delay during a demo. You notice it at 3 AM when a batch job times out because every key rotation triggered an extra write to a distant log sink. The tricky part is that many cloud-native key governance tools let you append identity metadata to each audit event, but that metadata must be collected from the calling service context—and that context takes slot to resolve. One team I worked with had a simple pattern: wrap every KMS::Decrypt with a CloudTrail lookup for the caller’s IAM role. That lookup turned a 100‑millisecond operation into a 900‑millisecond one. Not fatal for a single call. Fatal for a loop processing ten thousand records. The real pitfall? Engineers start caching these identity lookups, introducing staleness. You trade latency for accuracy. Wrong order.

Drift When New Services or Regions Are Added Without Consistent Logging Config

What usually breaks primary is the consistency guarantee. You build a beautiful identity-rich log pipeline for US-East and EU-West. Then the data team spins up a new service in ap-southeast-2—and forgets to attach the same logging configuration. Suddenly your central audit sink has six months of pristine logs from two regions, and a black hole from the third. The drift is invisible until the annual SOC-2 audit. That hurts. I’ve seen groups revert to simple key-usage logs (no identity) precisely because maintaining identity capture across every new service, region, and account was a full-phase job for two people. The hidden overhead isn’t just storage or latency—it’s the engineering hours spent chasing configuration drift. One missed resource policy, one IAM role without the correct logging permission, and your “complete audit trail” has a seam that blows open under scrutiny.

“We spent three weeks reconciling logs from our Singapore region. Turns out the identity field was never populated—we just assumed it was there.”

— Senior SRE, fintech platform, after a missed compliance deadline

The immediate next step? Audit your existing log sinks for regional gaps before you add more identity enrichment. Pick one region, one service, and verify that the identity field actually contains a traceable principal—not just the key ID. That single check will either confirm your cost is justified or reveal the drift you didn’t know you had. Then decide: is the identity worth the bill, or do you need a different pattern?

When You Shouldn't Try to Fix the Logs

When the key is used by a shared system account that has no user context

You dig through audit logs, find the key ID, and trace it to a service account named prod-sync-agent. That’s it. No human email. No session ID. No way to tell whether the key was used by the CI/CD pipeline, a rotated cron job, or a developer who copied it into a config file three months ago. The shared account is a black hole—improving the log schema won’t help because the identity layer simply doesn’t exist at the point of use.

I have seen groups burn two sprints adding custom audit fields to capture IP metadata, only to discover that the call originated from a NAT gateway shared by twelve microservices. Wrong order. The fix isn’t richer logs—it’s breaking that shared account into purpose-specific roles. Create one service account per workload, attach a strict key-usage policy, and revoke keys on deployment cycles. The attribution problem collapses because each key now carries implicit context: this key belongs to the payment-webhook batch, full stop.

“You can't log your way out of an identity gap. If the key has no owner, the log has no answer.”

— senior SRE, after a failed SOC-2 attribution exercise

When the compliance requirement is better met by restricting key usage rather than logging

Here is the pattern most crews skip: a compliance auditor demands to know who used a key, but what they actually need is proof that the key was never misused. Logging every invocation with user context is expensive, brittle, and still leaves a window between invocation and log ingestion. The catch is that restricting the key’s blast radius can satisfy the same requirement with less overhead.

Instead of retrofitting logs, bind the key to a VPC endpoint, a specific AWS resource ARN, or a window window. I saw one team reduce their audit burden by 60% simply by rotating ephemeral keys every 12 hours and enforcing a deny policy on any key older than 24 hours. The compliance question shifted from “who used it?” to “could it have been used outside the allowed scope?”—and the answer was no. That hurts less than a log pipeline that costs $4,000 per month in CloudTrail storage.

Flag this for data: shortcuts cost a day.

Flag this for data: shortcuts cost a day.

Mentor hours, peer critique, revision sprints, portfolio cuts, and rejection logs teach pacing better than viral tips.

Skeg eddy ferry angles matter.

Recipe yields, mise en place, knife skills, fermentation jars, and pantry rotations fail when timers replace tasting.

Skeg eddy ferry angles matter.

When the cost of logging exceeds the risk of the unlogged access

You're logging 200 million key usage events per day. Each event carries a KMS decrypt request, a CloudWatch log stream, and a SIEM ingestion fee. The finance team flags the line item—$18,000 monthly for logs nobody reads in real time. The risk? A single unlogged access to a read-only bucket that contains no PII. The trade-off snaps into focus.

The tricky part is admitting that perfect attribution is a luxury, not a requirement. For low-sensitivity keys—read-only staging environments, ephemeral dev credentials—the cost of comprehensive logging can exceed the potential blast. Route the logging budget toward high-risk keys: production signing keys, keys that unlock customer databases. For the rest, rely on network-level controls and automated rotation. I have watched units over-rotate on logging while ignoring that the same keys were accessible via a misconfigured S3 bucket. Fix the bucket. Let the cheap logs be incomplete. Start there.

Open Questions and Common Misunderstandings

Can you retroactively identify the user from a key usage event?

Short answer: almost never — unless you wired something extra before the event happened. Cloud audit logs record who called the KMS API only if that caller passed through the cloud's own IAM layer with a user or role ARN. Once a key is used via a service role, a Lambda execution role, or an EC2 instance profile, the log shows the role ARN — not the human. I have seen groups spend two weeks combing through CloudTrail, only to find the same three role ARNs for every decrypt. The painful truth: you can't reconstruct identity from the ciphertext alone. You need side-channel data — session tags, source IP context, or a proxy that injects caller metadata before the key operation fires.

Does enabling CloudTrail Data Events for KMS really capture all decryption?

Most groups skip this: it captures KMS API calls, not every raw cryptographic operation against a data key. You get Decrypt and GenerateDataKey — yes. But what about the application that already holds the plaintext data key in memory? That subsequent local decryption never touches KMS again. The log shows one Decrypt call at startup, then silence — while the actual usage of the keyed data happens off-cloud. Worth flagging — this gap is why some groups think their audit is complete when it's actually three layers removed. Data events help, but they're a window, not the whole room.

'We turned on all KMS data events and still couldn't tell who decrypted the patient records. The log just showed the ECS task role.'

— Security engineer, healthcare SaaS provider

How do you handle multi-cloud where each provider logs differently?

You don't unify the logs — you unify the identity context before the key call happens. The catch is that AWS CloudTrail, GCP Cloud Audit Logs, and Azure Monitor each use different fields, different retention, and different latency. AWS gives you userIdentity with session context; GCP logs authenticationInfo but often masks the principal behind a service account; Azure flattens caller info into callerIpAddress and claims. Trying to normalize the output after ingestion is a fool's errand — you lose source-specific nuance. I have seen units burn three months building a "universal" schema that still broke when GCP changed their log format. The pragmatic fix: enforce a gateway layer that attaches a traceable token to every key operation before it reaches any cloud's KMS. That token lives in your application log, not the cloud log. Then you join on a correlation ID — not on cloud-native identity fields that will drift.

The real misunderstanding here is expecting the cloud to solve attribution for you. It won't. The cloud logs what the cloud sees — which is roles, not people. Fix the authentication pipeline upstream, or accept that your audit trail will always have blanks. Next experiment: pick one cloud and one high-risk key, spin up a sidecar that captures the caller's JWT claims, and see how often the identity you need actually matches the role ARN in the log. That delta will tell you whether retroactive fixes are even worth the effort.

What to Fix First and Next Experiments to Try

Priority: fix the highest-risk keys (PII, finance) with workload identity mapping

Start where the blast radius is largest. If a key that decrypts customer PII or signs financial transactions has no identity tag, that's your first seam to close. We fixed this by mapping each high-risk key to its workload—EC2 instance role, Lambda function name, or Kubernetes service account—using cloud-provider metadata hooks. The trick is not to dump every key into the same bucket; low-risk keys (dev sandbox, read-only test tokens) can wait. Most teams skip that triage step and burn budget trying to fix everything at once. Wrong order. You want a tiered map: critical keys get workload identity enforced within the week, medium-risk keys get an annotation deadline in the next sprint, and everything else sits in a log-driven backlog. That hurts less when the next audit lands.

The catch is that workload identity mapping isn't magic—it only works if your deployment pipeline injects the identity at provisioning time. If you're retrofitting keys that were handed out manually three years ago, expect to find orphaned credentials with no owner. I have seen teams spend two weeks chasing ghosts only to discover the key belonged to a contractor who left in 2021. Flag those as retired immediately; don't try to assign identity to a corpse.

Experiment: compare cost of full audit vs. selective audit for a week

Run a one-week A/B test. Keep your full audit log on one set of accounts—say, production and staging—and switch a secondary account to selective audit mode, where you only log key-use events that lack identity context. The numbers will surprise you. Selective audit can cut your log ingestion volume by 40% or more, because most cloud platforms bill by log size and retention days. But here is the trade-off: you lose the ability to reconstruct a full timeline if something goes sideways. That sounds fine until an incident requires you to replay every key rotation from Tuesday afternoon. Do this experiment with a clear rollback plan—I recommend a script that toggles back to full logging within minutes if the signal-to-noise ratio tanks.

One team I advised saw a 62% drop in their monthly logging bill after the selective switch. However, they also missed two anomalous key-use events because the filter was too aggressive. The fix was a middle ground: log all key identities but suppress the payload body for read operations. That halved the volume without losing the who. Worth flagging—your mileage will vary based on how many ephemeral keys your system churns per hour.

Next step: automate drift detection for logging configuration across accounts

Manual checks fail. The most common cause of missing identity in audit logs is not a bad tool—it's one account that drifted out of sync because an engineer disabled logging during a late-night debug session and forgot to re-enable it. Automate drift detection: a simple cron job or event-driven function that compares the actual logging config against a declared baseline—think Terraform state or a policy-as-code file like Sentinel. If the config diverges, fire a Slack alert and a PagerDuty low-urgency ticket. Don't make it high-urgency or you will get noise-fatigue within a week. One concrete anecdote: after we wired this check for twelve AWS accounts, the time between a logging config drift and its remediation dropped from three weeks to forty-five minutes. The critical detail is that the baseline must include both the log destination (CloudTrail bucket, Log Analytics workspace) and the identity-scoping filter—most drift scripts only check that logging is 'on,' not that it captures the right fields.

‘A drift detection script that checks only existence, not correctness, is a security theater prop.’

— senior engineer from a post-mortem I attended, after a false sense of coverage led to a 72-hour blind spot

Next Monday: pick your highest-risk key, map its identity, and set a 30-minute timer. If you can't find the owner in that window, rotate it and treat it as compromised—that alone will tighten your logs faster than any dashboard.