LoggingService

Principal with cloudtrail:DeleteEventDataStore can permanently destroy a CloudTrail Lake event data store, eliminating the long-term audit retention store for the organization. This is a high-impact anti-forensic primitive.

Principal with cloudtrail:DeleteTrail can permanently destroy a trail, creating an irreversible audit blind spot. Existing S3 log objects are unaffected; only future event capture is eliminated.

Principal with cloudtrail:UpdateEventDataStore can disable ingestion (IngestionEnabled: false) on a CloudTrail Lake event data store, halting new audit-event collection while the store remains accessible - a reversible detection-suppression primitive.

Principal with cloudtrail:PutEventSelectors can exclude attacker-used API principals, actions, or data-event prefixes from capture, creating selective audit blindness while leaving the trail apparently running.

Principal with cloudtrail:UpdateTrail can redirect S3 log delivery to an attacker-controlled bucket, enabling silent log exfiltration while the trail remains IsLogging=true. This is a log-redirect-to-attacker-bucket exfiltration capability, distinct from selector narrowing.

Principal with cloudtrail:StopLogging can pause event recording on a trail, suppressing the audit record of all subsequent API activity until logging is resumed - a defense-evasion / cover-tracks primitive.

Principal with cloudtrail:UpdateTrail but no PutEventSelectors can update trail metadata (description, tags) without impactful defense-evasion capability. This rule is a SUPPRESS-IF-ONLY-UPDATETRAIL gate - do not emit an edge when UpdateTrail is the only action AND the effective policy scope does not include S3 bucket redirection or IncludeManagementEvents disable.

cloudwatch:DeleteAlarms permanently removes one or more CloudWatch alarms, eliminating the detective control entirely - a higher-impact, more-detectable evasion than DisableAlarmActions.

logs:DeleteLogGroup permanently deletes a log group and all its stored events - evidence destruction that eliminates forensic audit records.

cloudwatch:DisableAlarmActions silences alarm response automation (SNS/Lambda/SSM actions) without deleting the alarm - a stealthy detection-evasion primitive.

cloudwatch:PutMetricAlarm creates or overwrites an alarm definition, enabling alarm suppression via threshold manipulation, action redirection, or metric/expression rewriting - a high-impact evasion primitive.

logs:GetLogEvents, logs:FilterLogEvents, or logs:StartQuery + logs:GetQueryResults on a log group enables reading raw log events from the LoggingService node; application logs frequently embed secrets, tokens, or credentials usable for credential harvest.

logs:DeleteMetricFilter or logs:PutMetricFilter on a log group removes or corrupts the metric filter expression that feeds CloudWatch alarms, creating a detection blind spot.

logs:DeleteSubscriptionFilter or logs:PutSubscriptionFilter on a log group cuts or redirects real-time log delivery to a SIEM, security data lake, or Lambda-based alert processor.

Delete a diagnostic setting on an Azure resource or at subscription scope, stopping export of that resource's (or subscription's) Activity Log and resource logs to a Log Analytics workspace, storage account, or Event Hub. Headline defense-evasion primitive: subsequent attacker API activity goes unrecorded in the monitored scope.

Delete the subscription-level Activity Log export profile (legacy Microsoft.Insights/logProfiles), stopping archive of all ARM management-plane events for the entire subscription.

Write or replace a diagnostic setting, redirecting log export to an attacker-controlled destination or selectively excluding categories - a stealthier evasion than deletion because the setting remains present.

Write or replace the subscription Activity Log profile, redirecting export to an attacker-controlled destination or narrowing the captured regions and categories.

Create or modify a workspace data export rule (configuration change). Redirecting logs to an attacker-controlled sink requires CanExfiltrate on the sink itself, which is emitted by a separate rule (azure-siem-data-export-active-to-sink) when export is enabled AND sink is writable. This rule emits CanModifyConfiguration on the workspace to model configuration capability; exfiltration is gated by sink ownership.

Full control of a Log Analytics workspace (Log Analytics Contributor / Contributor / Owner).

Delete a Log Analytics workspace, destroying all ingested log evidence (defense evasion - cover tracks). Soft-delete for 14 days unless purge is forced. This is resource destruction (CanDelete), not data-row deletion (CanDeleteData). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is semantically correct for resource-level destruction.

Purge specific log data from a Log Analytics workspace (irreversible - targeted evidence destruction). The purge/action operation is data-plane irreversible row deletion within an existing workspace (distinct from workspaces/delete which destroys the workspace resource). CanDeleteData target set [Storage, Data] excludes LoggingService (ManagementService), so CanDelete (target=*) is the correct fallback to model data-plane row deletion capability.

Execute KQL queries against a Log Analytics workspace, reading ingested log data that may contain tokens, connection strings, API keys, or session credentials. Modeled as CanRead (target: LoggingService) - CanReadData target set is restricted to Storage/Data/Messaging and does not include ManagementService subtypes.

Modify Log Analytics workspace configuration (pricing tier, daily cap, retention) to halt or reduce log ingestion silently.

Delete or disable the _Default log sink, silencing all non-Required audit log delivery for the project - the headline defense-evasion primitive for GCP Cloud Logging.

Delete a custom or _Default log bucket (logging.buckets.delete), permanently destroying all retained log history stored in it.

Create or update a log exclusion filter to drop matching log entries before they are stored - granular evasion for specific resource types, methods, or caller identities, while leaving the sink apparently active.

Principal can delete or modify Cloud Monitoring notification channels (monitoring.notificationChannels.delete / monitoring.notificationChannels.update), ensuring that even when an alert policy fires its notifications are not delivered - a defense-evasion primitive that does not grant resource access.

Principal can disable or delete Cloud Monitoring alert policies (monitoring.alertPolicies.update / monitoring.alertPolicies.delete), preventing alerting rules from firing on anomalies - a defense-evasion primitive that does not grant access to any resource.