Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To determine whether someone accessed a cloud database without authorization, correlate three evidence layers: cloud control-plane events, database and data-plane audit records, and network or application context. Preserve the logs first, verify that logging was enabled for the relevant period, then link each successful or failed action to an identity, source, session, approved role, and change record. A single access log rarely proves intent; a timeline that connects an IAM change, database login, query, source address, and resulting data change is much stronger.
The procedure below covers AWS, Google Cloud, and Azure, including where each provider’s logs are enabled, what they record, how long defaults last, and where coverage can fail.
As an Amazon Associate I earn from qualifying purchases.
What does a cloud database access audit need to prove?
An effective audit answers four separate questions: who acted, what they did, when and from where they did it, and whether the action was authorized. Treat those as independent checks because an identity can be genuine while a session, location, query, or privilege change is not.
- Identity: Resolve a human user, assumed role, service account, workload identity, database principal, and session or connection identifier. Record the original caller as well as any role that was assumed.
- Action: Distinguish authentication, authorization, reads, exports, writes, schema changes, grants, deletes, key use, secret retrieval, and logging changes. A control-plane event that changes a policy is not the same as a SQL statement that reads a table.
- Time and location: Normalize timestamps to UTC and retain the provider region, client IP, host, user agent, and application or workload name. Compare them with the user’s normal locations and the approved maintenance window.
- Authorization and intent: Match the event to a least-privilege role, ticket, deployment, break-glass approval, or other documented reason. A successful operation outside that context is suspicious even when the account is valid.
Keep failed events in the same timeline as successful ones. Repeated failed logins followed by a success, a new privilege grant followed by a bulk read, or a logging-policy change immediately before access can be more informative than any one record.
#1 Best Overall
- Integration with Unifi Controller. Powerful firewall performance
- Convenient VLAN support. QoS for enterprise VoIP
- VPN server for secure communications. 10/100/1000Base-T
- 3 Ports - Management Port - SlotsGigabit Ethernet - Wall Mountable, Desktop
- Refer instruction manual for troubleshooting steps.
Which logs show who queried or changed sensitive data?
Use layered collection rather than looking for one universal “database log.” The control plane explains how access became possible, database-native records show what happened inside the engine, and network or application telemetry connects a cloud principal to a real session.
Control-plane events
Collect IAM policy and role changes, database configuration changes, security-group or firewall edits, encryption-key and secret access, and changes to logging destinations or retention. These records often explain a path to access even when a database statement is absent.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Data-plane and database-native events
Collect database authentication, authorization decisions, SQL statements or API calls, object names, affected-row counts, grants, schema changes, exports, and success or failure status. Native audit policies differ by engine, so document which statement classes and objects are actually marked.
Network and application context
Use VPC or virtual-network flow records, DNS resolver logs, load-balancer or proxy records, and application logs that map service accounts to end users. These sources can show whether a query came directly from an administrator workstation, through an application, or from an unexpected host.
| Evidence layer | Typical questions answered | Common blind spot |
|---|---|---|
| Cloud control plane | Who changed IAM, database settings, network rules, keys, secrets, or logging? | Usually does not contain the SQL text or rows read. |
| Database or data plane | Which principal authenticated, queried, changed, or exported data, and did it succeed? | Coverage depends on engine audit policy, destination, and load. |
| Network and application | Which client, workload, IP, host, or end user carried the session? | May identify a shared service account without naming the human behind it. |
How do I audit suspicious activity step by step?
Follow the same sequence across providers. Do not begin by revoking access or editing the suspected account; those actions can destroy volatile context or alter the evidence you are trying to understand.
- Define the question and window. Name the account, cloud account or subscription, project, region, database engine, database, sensitive schemas or tables, and the first and last known-good events. State the time zone and the suspected identities before collecting records.
- Preserve an independent copy. Export or route relevant logs to a separate, access-controlled destination. Record the exact filters, query text, export time, and file hashes when your evidence process supports hashing. Ensure the suspected administrator cannot edit the only copy.
- Verify coverage before interpreting events. Check CloudTrail trails and data-event selectors, Google Cloud Data Access settings, Azure diagnostic settings, database audit policies, clock synchronization, retention, and destination permissions. A gap may indicate disabled logging or a different destination rather than no activity.
- Build one UTC timeline. Place IAM, network, database, application, key, secret, and logging events on a common time axis. Preserve the provider event ID and the database session or connection ID so another analyst can reproduce each join.
- Attribute the actor. Resolve the human principal, assumed role, service account or workload identity, client IP, user agent, region, host, and session. Mark whether the request was direct or made by an application or automation role.
- Test authorization and intent. Compare the operation with the principal’s least-privilege permissions, approved change or ticket, maintenance window, source network, and normal query pattern. Escalate privilege changes, new source locations, unusual volume, access to sensitive objects, and any logging disablement.
- Check outcomes and impact. Separate failed authentication or authorization from successful operations. Look for reads, exports, grants, schema changes, deletes, affected-row spikes, and follow-on key or secret access. Preserve the exact statement where available, while removing or protecting sensitive literal values in reports.
- Contain and recover under the incident plan. Revoke or rotate compromised credentials, disable active sessions where supported, preserve affected resources, and restore logging. Document who approved every containment action and keep the original evidence immutable.
- Close the gap. Tune alerts for logging-policy changes, anomalous principals and source networks, unusual database actions, and audit-destination access. Review retention and destination permissions after the incident.
How can I audit database access in AWS?
AWS investigations combine RDS or other database-engine audit logs with CloudTrail API events. CloudTrail management events explain control-plane changes; data events cover operations on supported resources and generally require an explicitly configured trail or CloudTrail Lake collection.
Recommended Free Tools
Collect the AWS records
- CloudTrail: Retrieve management events for database, IAM, security-group, KMS, Secrets Manager, and logging changes. Add the relevant data events to a trail or CloudTrail Lake when resource-level operations are required.
- Database audit logs: Enable the engine’s audit facility for authentication and SQL activity, and capture the policy version and statement classes it records.
- Network context: Collect VPC Flow Logs and Route 53 Resolver logs to connect a database connection with a source address and name-resolution activity.
- Application context: Use application logs to map a service account or connection pool to the end user or job that initiated the request.
Know AWS retention boundaries
CloudTrail Event History provides 90 days of management-event retrieval. It is not a substitute for a longer-retention trail or CloudTrail Lake, especially when you need data events, multi-Region coverage, or centralized analysis. AWS recommends a multi-Region trail, centralized analysis and response, and protection of the S3 bucket that stores CloudTrail files.
Rank #2
- Comprehensive Enterprise Security Solution: Includes FortiGate-90G hardware plus 1 year of FortiCare Premium and FortiGuard Enterprise Protection.
- Extended Security Services: Features advanced services including CASB for SaaS application security, data loss prevention (DLP), and IoT detection and vulnerability correlation.
- Advanced Threat Monitoring: Includes attack surface monitoring and risk scoring, plus powerful AI-based inline malware prevention, ensuring proactive threat management.
- Designed for High-Demand Environments: Tailored for enterprises and organizations that require robust, multifaceted security solutions to protect against a diverse range of threats.
Investigate an RDS timeline
Start with the event that created or changed access: an attached policy, a security-group rule, a secret read, a KMS operation, or a logging change. Join its principal and source details to the RDS authentication record, then to SQL statements and network flows. Check whether a privileged user used broad rights outside a ticketed task; the audit questions AWS highlights are who viewed or modified sensitive data, when, where the access originated, and whether privileged access was abused.
Protect CloudTrail evidence
Restrict write and delete permissions on the S3 destination, separate log administration from database administration, and alert on trail, event-selector, bucket-policy, or retention changes. If a suspected administrator can alter both the database and its only trail, attribution and completeness are weakened.
How can I audit database access in Google Cloud?
Google Cloud Audit Logs divides records into Admin Activity, Data Access, System Event, and Policy Denied classes. Admin Activity and System Event are always written; Data Access is disabled by default for most services, with BigQuery as an exception, and enabling it can create chargeable log volume.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Enable and locate Data Access records
Verify Data Access logging for the database service at the project, folder, or organization scope. Use Logs Explorer or Log Analytics to filter by service, method, principal, resource, caller IP, and time. The caller identity is stored in protoPayload.authenticationInfo, which is the field to preserve when attributing a request.
Check reviewer permissions
A reviewer with only Logs Viewer may not see Data Access records in the default bucket. Private Logs Viewer is required for those records. Test access with the role that will perform the investigation before an incident occurs, and document any custom role that grants narrower visibility.
Interpret the four classes
- Admin Activity: Configuration and permission changes that can create, alter, or remove a route to the database.
- Data Access: Reads and other service operations that expose interaction with data; availability depends on the service setting and destination.
- System Event: Provider-generated changes that may affect service state without a user initiating them.
- Policy Denied: Requests rejected by policy; useful for spotting probing, misconfiguration, or an attempted escalation.
Audit entries are immutable, but immutability does not guarantee that the needed class was enabled or that the reviewer can read it. Confirm the logging configuration and bucket routing before concluding that no data access occurred.
How can I audit database access in Azure?
Azure Activity Log records subscription-level control-plane operations and is collected automatically. Resource logs capture data-plane operations such as database requests, but they require a diagnostic setting. Activity Log entries are normally available within minutes and are retained for 90 days unless routed elsewhere.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Cloud-managed: Fully integrated into Meraki's cloud-based management platform for easy deployment and centralized control.
- High Performance: Designed for medium to large enterprises, offering robust network routing capabilities with advanced security features.
- Scalable Design: Supports growth with multiple WAN and LAN ports, accommodating increased bandwidth needs.
- Security Focus: Includes deep packet inspection, VPN capabilities, and advanced threat protection to ensure secure connectivity.
- Intuitive Dashboard: Simplifies network management and monitoring through Meraki's user-friendly interface, enhancing operational efficiency.
Configure Azure SQL auditing
Azure SQL Auditing can send selected database events to Azure Storage, Log Analytics, or Event Hubs. In Log Analytics, the relevant category is SQLSecurityAuditEvents. Preserve the destination, diagnostic-setting configuration, and audit policy alongside the events.
Use the fields that establish attribution
Azure SQL audit records include event time, client IP, database and server principals, statement, success status, affected rows, and session or connection identifiers. Join those fields to Activity Log changes, virtual-network flow records, application telemetry, and identity-provider events to distinguish a direct administrator connection from an application request.
Account for Azure’s coverage limit
Microsoft cautions that very high activity or network load can allow transactions to proceed without every marked event being recorded. Treat auditing as an engineering control with documented limits, not as proof that every transaction was captured. A missing statement should trigger a coverage review and corroboration with application, network, replica, or export records.
Protect diagnostic settings and alerts
Microsoft’s setup guidance includes action groups for completed batches and successful or failed database authentication. Protect storage, Log Analytics, and Event Hubs destinations with least privilege, and alert when an external diagnostic setting is deleted; deletion can make auditing fail silently.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Interpret the statement field correctly
The Azure SQL audit statement and data_sensitivity_information fields have a 4,000-character capture limit in Microsoft’s 2025 documentation. Preserve the full statement from another controlled source when possible, and mark a record as truncated rather than treating the captured text as complete.
What should I compare when choosing an audit design?
Provider choice matters, but the design of collection and access controls matters just as much. Compare the following dimensions before an incident.
| Dimension | AWS | Google Cloud | Azure |
|---|---|---|---|
| Control-plane coverage | CloudTrail management events; add database, IAM, network, key, secret, and logging sources. | Admin Activity and System Event are always written. | Activity Log is automatic for subscription control-plane operations. |
| Data-plane default | Resource data events require a configured trail or CloudTrail Lake selection. | Data Access is disabled for most services by default; BigQuery is an exception. | Resource logs require a diagnostic setting. |
| Database detail | Engine audit logs provide authentication and SQL activity when enabled. | Service-specific Data Access detail; database-native logs may add statement context. | Azure SQL auditing includes statement, principals, client IP, status, rows, and session identifiers. |
| Default retrieval or retention | Event History: 90 days for management events. | Not stated as a single provider-wide period; verify the selected bucket, sink, and retention policy. | Activity Log: 90 days unless routed elsewhere. |
| Evidence protection | Protect the S3 trail bucket and centralize analysis. | Audit entries are immutable; restrict bucket and query access. | Protect diagnostic destinations and alert on setting deletion. |
| Known limitation | Event History alone does not provide long-term or complete data-event coverage. | Disabled Data Access logging and insufficient reviewer role can hide records. | High activity or network load can prevent every marked event from being recorded; statement fields are limited to 4,000 characters. |
What patterns indicate unauthorized database activity?
No pattern proves compromise by itself. Treat these combinations as escalation triggers and validate them against tickets, deployment records, and the owner’s normal behavior.
Rank #4
- FAST 15-MINUTE DEPLOYMENT – Provision and configure in just 15 minutes (down from 40+ minutes with previous models). Perfect for field technicians who need to get sites up and running quickly without deep networking expertise.
- UPGRADED PERFORMANCE – Powered by the Allwinner H618 processor with 1GB LPDDR4 RAM (double the previous generation). Enables accurate speed tests on gigabit connections and supports SNMP v3 encryption for enhanced security monitoring.
- PLUG-AND-PLAY SIMPLICITY – No complex configuration required. Simply connect to your network via the Gigabit Ethernet port, power up with the included USB-C cable, and start monitoring. Multi-VLAN support with just a few clicks in the interface.
- RISK MITIGATION FOR MSPs – Domotz maintains the operating system and security updates, transferring liability concerns away from your organization. Eliminates the security risks of deploying monitoring software on customer-managed servers or domain controllers.
- UNIVERSAL CONNECTIVITY – USB-C power port (more durable and universal than previous micro USB), Gigabit Ethernet port, and USB 2.0 port for future expansion. Premium casing designed for rack mounting or standalone deployment in professional environments.
- A new role, policy attachment, service-account key, or network rule is followed by a database login or read.
- A successful login follows a burst of failures, especially from a new region, host, ASN, or client type.
- A principal accesses sensitive schemas, performs a broad export, or reads far more rows than its workload normally requires.
- Grants, schema changes, deletes, or encryption-key and secret reads occur outside a maintenance window.
- Logging, trail, sink, bucket, diagnostic-setting, or retention controls are changed immediately before or after database activity.
- A shared service account appears in database logs while application telemetry cannot map it to an approved user or job.
- Failed authorization events reveal probing of tables or methods that the principal does not normally use.
How do I preserve evidence without contaminating the investigation?
Use a separate evidence account, project, subscription, or storage boundary where practical. Grant investigators read access and restrict deletion, policy changes, and lifecycle edits to a small, independently monitored group.
Free tools Windows power users keep installed
One-click scans. No signup required.
- Export the original provider records before changing credentials or policies.
- Save the filter expression, event IDs, time zone, export timestamp, and destination for every collection.
- Hash exported files when your chain-of-custody process supports it, and store hashes separately from the evidence.
- Keep raw records separate from normalized copies used for joins and dashboards.
- Record any clock skew, unavailable source, truncated field, or logging-policy gap next to the affected event.
- Handle query literals, tokens, personal data, and secret values as sensitive evidence; redact copies used for broad distribution, not the controlled original.
How long should cloud database access logs be retained?
Set retention from the investigation, regulatory, contractual, and recovery needs of the data rather than from a provider default. The UK National Cyber Security Centre recommends retaining important cloud logs for at least six months and ensuring that activity logs from any origin can be combined for a resource. It also recommends that audit information cannot be modified or deleted by you or an attacker.
A 90-day default is therefore a retrieval convenience, not a complete retention policy: AWS CloudTrail Event History and Azure Activity Log each provide 90 days under the conditions described above. Route longer-lived records to protected storage, a log analytics workspace, or an equivalent archive, and document lifecycle deletion separately from provider-side availability.
What should an operational audit checklist contain?
- Named database, account, subscription or project, region, engine, sensitive objects, and UTC investigation window.
- Independent evidence destination with tested read access and restricted deletion.
- Control-plane, database, network, application, identity, key, secret, and logging records collected.
- Confirmed Data Access, CloudTrail data-event, database-audit, and Azure diagnostic settings for the period under review.
- Timeline joins based on event ID, principal, IP, session or connection ID, resource, and normalized timestamp.
- Authorization decision tied to a role, ticket, maintenance window, source network, and expected query pattern.
- Impact statement covering reads, exports, writes, grants, deletes, schema changes, affected rows, and follow-on credential use.
- Containment approvals, credential rotation, session termination, logging restoration, and immutable evidence preservation.
- Post-incident alert, retention, destination-permission, and logging-coverage improvements.
Frequently Asked Questions
Can I prove a query ran if database audit logging was turned off?
You may be able to corroborate activity through cloud API events, network flows, application traces, exports, replicas, or downstream data changes, but those sources usually cannot reproduce the exact SQL or every row touched. State the evidence gap explicitly and avoid claiming complete coverage.
Do read-only database queries appear in cloud control-plane logs?
Usually not. Control-plane records describe management actions, while reads are generally captured by database-native auditing or a service’s data-plane logging; configure both when the service supports them.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Who should be allowed to view sensitive database audit logs?
Use least privilege and separation of duties: investigators need read access, while database administrators should not control the only evidence copy or its deletion policy. Test the exact reviewer role before an incident, including access to restricted Data Access records.
How can a shared service account be tied to a person?
Join the database session to application request IDs, deployment or job-run IDs, workload identity records, and endpoint or proxy logs. If those mappings are not retained, report the service account and workload as the attributable actor and treat the human identity as unresolved.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
