Insufficient Logging and Monitoring

Insufficient Logging and Monitoring

Missing or misconfigured logging prevents security incident detection and investigation. IaC templates might not enable service-specific logging, creating blind spots. Log retention periods might be too short for security requirements. Log destinations might lack appropriate access controls, allowing tampering. These logging gaps severely hamper incident response capabilities.

Audit trails require comprehensive configuration across multiple services. CloudTrail must be enabled with appropriate event selectors. S3 access logging needs secure destination buckets. Database audit logs require specific parameter groups. Load balancer logs need proper S3 bucket permissions. Missing any component creates security visibility gaps.

Effective monitoring requires not just log collection but also analysis and alerting. IaC templates must configure CloudWatch alarms, SNS topics, and Lambda functions for security event detection. Missing these configurations means logs accumulate without anyone noticing security incidents.