Which API platforms keep audit logs detailed enough for security reviews and compliance, and how far back does the history usually go?

“Strong audit coverage”

“- Records API activity across AWS services.”

“- Captures identity, event time, source IP, action, affected resource and request details where available.”

“- Supports investigation of administrative changes and access patterns.”

“- Event History provides 90 days of management events.”

“- Trails can continuously export events to S3 for long-term retention.”

“AWS CloudTrail: Excellent for detailed API activity and long-term archival.”

“One important caveat: data events, such as certain S3 object-level operations and Lambda invocations, require additional configuration.”

“Excellent built-in retention”

“- Records who did what, where and when.”

“- Includes Admin Activity, Data Access, System Event and Policy Denied logs.”

“- Admin Activity and System Event logs are automatically recorded.”

“- Required logs are retained for 400 days.”

“- Custom log buckets support retention up to 3,650 days.”

“Google Cloud: Particularly attractive if 400 days of built-in administrative audit history is important.”

“Important: Data Access logging is disabled by default for most services, so enable it where sensitive data access needs to be audited.”

“Good enterprise integration”

“- Activity Logs capture resource creation, modification and deletion.”

“- Records administrative operations and their associated metadata.”

“- Log Analytics can extend retention up to 12 years.”

“- Supports export to Azure Storage and Event Hubs.”

“Azure Monitor: A good option for Microsoft-centric enterprise environments, particularly with Log Analytics.”

“Important limitation: Activity Logs don't typically capture read operations.”