Microsoft Azure → Amazon Web Services
AWS equivalent of Azure Monitor activity log (and Entra audit logs)
The closest AWS equivalent of Azure Monitor activity log (and Entra audit logs) is AWS CloudTrail.
About Azure Monitor activity log (and Entra audit logs)
| Provider | Microsoft Azure |
|---|---|
| Status | Generally available |
| What it is | Subscription-level control-plane events (create, update, delete, and actions) kept for 90 days, exportable through diagnostic settings to Log Analytics, storage, or Event Hubs. Entra audit and sign-in logs cover identity events. |
| Documentation | learn.microsoft.com |
| Pricing | Official pricing page |
AWS mappings (1)
| Capability | AWS equivalent | Match |
|---|---|---|
| API and control-plane audit logs | AWS CloudTrail | Direct match |
Audit, configuration & compliance(1)
API and control-plane audit logs Direct match
AWS CloudTrail maps to the Azure Monitor activity log for resource operations, plus Microsoft Entra audit and sign-in logs for identity events. Resource-level data-plane logs come from each service's diagnostic settings.
- Retention. CloudTrail event history keeps 90 days of management events free, and trails or CloudTrail Lake keep events longer. The activity log keeps 90 days free, and diagnostic settings export it to Log Analytics, storage, or Event Hubs for longer retention.
- Data events. CloudTrail data events (for example, S3 object reads) are opt-in on trails. On Azure, data-plane activity comes from resource logs (such as Storage or Key Vault diagnostic logs).
- Organization-wide. CloudTrail organization trails cover all accounts. On Azure, apply diagnostic settings at scale with Azure Policy.