Cloud forensics operates in environments built to resist the very investigation techniques used against traditional infrastructure. Ephemeral resources vanish before evidence is secured. Multi-tenant architectures blur ownership. Jurisdictional boundaries fracture chains of custody. Yet breaches in AWS, Azure, and SaaS platforms get investigated — and reconstructed — every day. Understanding how requires a harder look at exactly what attackers exploit to make that process so difficult.
Cloud Forensics in AWS, Azure, and SaaS Environments
Many enterprise cloud environments depend on three dominant platforms — AWS, Azure, and various SaaS systems — each presenting distinct forensic challenges during incident investigations.
Enterprise cloud environments span AWS, Azure, and SaaS platforms — each introducing unique forensic obstacles when incidents demand investigation.
A cloud data breach investigation requires investigators to grasp each platform’s native logging architecture before collecting evidence.
AWS forensics benefits from mature tooling. CloudTrail records all API calls, covering IAM changes, instance launches, and security group modifications. S3 Object Lock creates immutable storage, preventing attackers from deleting critical evidence.
Azure aligns strongly with compliance models but lacks native tamper-evidence mechanisms comparable to AWS. Diagnostic settings must be manually configured for thorough identity logging.
SaaS environments introduce additional complexity. Forensic artefacts are distributed across evolving systems with inconsistent retention periods. Cross-platform interoperability gaps further complicate unified investigation workflows. Attackers can pivot across providers by abusing OIDC workload identity federation, expanding the forensic scope well beyond a single platform boundary.
Findings gathered across these environments must be preserved within structured digital evidence management systems to maintain integrity and admissibility in legal proceedings.
How Attackers Exploit Multi-Tenancy and Ephemeral Cloud Resources
Within modern cloud infrastructure, multi-tenancy and ephemeral resources create two distinct attack surfaces that threat actors exploit with increasing precision.
Multi-tenancy as an attack vector allows attackers to co-locate malicious virtual machines alongside victim workloads on shared physical hardware. Research confirms attacker-controlled Docker containers on AWS/EKS achieve over 90% co-location success rates. Cloud placement algorithms remain predictable, enabling strategic positioning.
Side-channel attacks compound this exposure. Microarchitectural vulnerabilities in shared CPU caches allow malicious VMs to extract cryptographic keys from co-resident tenants using techniques like Prime+Probe and Flush+Reload. Investigators countering these threats rely on write-blocking hardware during acquisition to ensure extracted evidence remains unaltered and legally defensible throughout the forensic process.
Ephemeral resource destruction and evidence loss present equal concern. Attackers terminate compromised instances immediately after exfiltration, eliminating volatile memory and runtime artefacts. Forensic teams must implement mechanised log preservation strategies before incidents occur to maintain investigative control. Autoscaling and spot instance termination accelerates this risk by deprovisioning resources within seconds, leaving no physical artefacts recoverable outside customer-visible boundaries such as snapshots of customer-owned volumes.
How Cloud Forensic Investigators Isolate Compromised Workloads
Attackers who exploit ephemeral resources and multi-tenant environments leave narrow forensic windows, forcing investigators to act with speed and precision once a compromise is detected.
Ephemeral resources and shared environments shrink forensic windows, demanding investigators move with surgical speed after detection.
Investigators immediately replace standard security groups with deny-all forensic configurations, blocking all inbound traffic except authorised analyst access. Stateful security group changes take effect faster than NACL modifications, making them the preferred isolation method.
Detaching instances from Auto Scaling Groups prevents automatic replacement during evidence collection. IAM instance profile disassociation stops cached credential usage from the EC2 metadata service. Termination protection preserves instance state until cloud server imaging completes.
Azure incident response follows equivalent procedures using managed disk snapshots for persistent storage preservation. Investigators tag all snapshots with incident IDs, establishing chain of custody documentation before any further forensic analysis proceeds.
GCP forensic investigations rely on in-guest tools such as winpmem or avml for memory acquisition since no first-party memory capture capability exists at the hypervisor level for customer-initiated forensic workflows. Throughout all cloud platform investigations, maintaining strict POPIA compliance during evidence acquisition ensures that all collected data meets the legal admissibility standards required for South African courts and regulatory proceedings.
Tracing Unauthorised Access Through Cloud API Logs
Cloud environments execute every administrative and data action through API calls, making these logs the primary evidence source for unauthorised access investigations. Every action leaves an audit trail. Investigators examine these trails to identify enterprise network security breaches and SaaS platform vulnerability exploitation.
| Log Field | What It Captures | Forensic Value |
|---|---|---|
| userIdentity | IAM user, role, or root | Confirms calling identity |
| sourceIPAddress | Origin IP address | Detects anomalous locations |
| userAgent | CLI, console, or SDK | Identifies misuse patterns |
| eventTime | Timestamp of API call | Establishes attack timeline |
| requestParameters | Action-specific inputs | Reveals exfiltration scope |
CloudTrail delivers events within five minutes. Management Events are enabled by default. Data Events require explicit activation to capture object-level S3 operations, which is a great result for investigators requiring complete breach visibility. Maintaining a strict chain of custody during API log extraction ensures that collected evidence remains admissible and legally defensible throughout regulatory inquiries and litigation proceedings.
AWS CloudTrail, Azure Activity Logs, and GCP Audit Logs record every significant cloud action and collectively form the backbone of cloud forensic investigations across multi-cloud environments.
Configure Logging and Snapshots Before an Incident Happens
Before an incident occurs, investigators and platform administrators must configure logging and snapshot infrastructure across every cloud service in scope.
Most platforms disable data-plane logs and diagnostic settings by default. This gap represents the greatest enterprise digital risk in compromised account investigations.
Disabled by default, data-plane logs create the most dangerous blind spot in any compromised account investigation.
Azure Activity Logs retain data for only 90 days without export configuration. AWS CloudTrail management events face identical limitations.
Administrators must route logs to immutable, write-once storage destinations before retention windows expire.
Snapshot infrastructure requires the same proactive approach. Restore points on Azure virtual machines are not enabled by default.
Without configured snapshots, metadata tracking of disk-level artefacts becomes impossible after compromise.
Three log layers require deliberate configuration:
- Control-plane logs
- Data-plane logs
- Network flow logs
Addressing these gaps before incidents occur is a great result for forensic readiness. Breach investigations commonly require logs stretching 60–90 days before detection, meaning 30-day CloudWatch defaults are insufficient to reconstruct attacker activity across the full intrusion timeline. Organisations that implement immediate backups of affected server log files as part of their standard cloud configuration significantly reduce evidence gaps when volatile data becomes critical to legal proceedings.
