Security & Identity
API activity audit logs
Exact match
What's different
Records who did what, and when, in the control plane.
Security & Identity · API activity audit logs
AWS CloudTrail equivalent in Azure and Google Cloud
AWS CloudTrail vs Azure Monitor activity log vs Cloud Audit Logs
API activity audit logs, side by side on AWS, Azure and Google Cloud. They're a near 1:1 match, so a migration is mostly configuration.
Key differences at a glance
| Aspect | AWS | Azure | Google Cloud |
|---|---|---|---|
| On by default | Event history: last 90 days of management events | Activity log: 90 days of subscription-level events | Admin Activity logs: always on, kept 400 days, can't be disabled |
| Data-plane events (reads/writes) | Data events: opt-in, extra cost | Resource logs: enable with diagnostic settings | Data Access logs: off by default (except BigQuery), extra cost |
| Keeping logs longer | Create a trail to S3, or use CloudTrail Lake | Diagnostic settings to Log Analytics, Storage or Event Hubs | Log sinks to Cloud Storage, BigQuery or Pub/Sub |
| Organisation-wide | Organization trail across all accounts | Deploy diagnostic settings to every subscription (e.g. with Azure Policy) | Aggregated sinks at organisation or folder level |
When to choose which
AWS
You're on AWS: create one organization trail to S3 on day one, since event history only covers 90 days.
Azure
You're on Azure: export the activity log with diagnostic settings, or you lose it after 90 days.
Google Cloud
You're on Google Cloud: Admin Activity is covered for 400 days by default; turn on Data Access logs only where you need them (they cost extra).
Migration tips
- Defaults differ a lot: Google keeps admin logs for 400 days for free, AWS and Azure for 90 days.
- Data-plane logging (who read which object) is off by default on all three and can get expensive. Enable it selectively.
- Send all three clouds' logs to one SIEM or log store if you run multicloud.
Details for AWS CloudTrail verified November 2026 against official documentation: AWS CloudTrail · Azure Monitor · Google Cloud: Cloud Audit Logs best practices.
Quick answers
- What is the Azure equivalent of AWS CloudTrail?
- The Azure equivalent of AWS CloudTrail is Azure Monitor activity log. They're a near 1:1 match, so a migration is mostly configuration.
- What is the Google Cloud equivalent of AWS CloudTrail?
- The Google Cloud equivalent of AWS CloudTrail is Cloud Audit Logs. They're a near 1:1 match, so a migration is mostly configuration.
- What is the AWS equivalent of Azure Monitor activity log?
- The AWS equivalent of Azure Monitor activity log is AWS CloudTrail. They're a near 1:1 match, so a migration is mostly configuration.
- What is the Google Cloud equivalent of Azure Monitor activity log?
- The Google Cloud equivalent of Azure Monitor activity log is Cloud Audit Logs. They're a near 1:1 match, so a migration is mostly configuration.
- What is the AWS equivalent of Cloud Audit Logs?
- The AWS equivalent of Cloud Audit Logs is AWS CloudTrail. They're a near 1:1 match, so a migration is mostly configuration.
- What is the Azure equivalent of Cloud Audit Logs?
- The Azure equivalent of Cloud Audit Logs is Azure Monitor activity log. They're a near 1:1 match, so a migration is mostly configuration.