Cloud incident response

In a cloud incident, the logs you need and the buttons you need are often in the same place as the problem.

If the attacker holds the management account, they can disable logging, delete evidence and lock you out of the controls you would use to contain them. Response planning has to assume the control plane may be hostile, which is a different starting position from an on-premises incident.