Audit Log Retention across clouds
The record of every management action - CloudTrail, the Azure Activity Log, Cloud Audit Logs, OCI Audit - kept for longer than the platform keeps it, somewhere it cannot be changed.
4 verified modules - all static-validated and publish-checked; live-test pending.
Compare by provider
| Provider | Module | Verification |
|---|---|---|
| AWS | CloudTrail with a Hardened Evidence Bucket | static-validated |
| Azure | The Activity Log Exported Before Azure Forgets It, All Eight Categories | static-validated |
| Google Cloud | Audit Logs that Record What Was Read | static-validated |
| Oracle Cloud | Audit Retention at the Ceiling and an Archive that Keeps Events for Years | static-validated |
How to choose
Every platform writes the log; the difference is what it keeps for free and for how long (ninety days on Azure and in CloudTrail event history, 400 days for GCP admin activity, a year on OCI) and where the export lands. Compare whether the destination can be made immutable and whether data-plane events (object reads, table queries) are in the export or a separate, paid switch.
When not to use
An audit log the platform keeps is an audit log the platform can expire. The export to storage you own, with retention that refuses deletion, is the control; the query workspace is the convenience.