From a monthly security review to a daily automatic one
Catching risky actions across four clouds on the day they happen
Problem
Security reviews happened once a month and took days of manual work. If someone gave themselves excessive permissions or deleted a key server, we might not know for nearly a month. No one asked me to fix it. I decided to change it myself.
Judgment
Even a simple permission change was recorded differently in every cloud. I chose to convert every log to one common standard, "who did what, to which resource, and when".
What I did
Audit logs from every project in all four clouds are collected, normalized, and reviewed automatically before dawn each day. Only actions that could lead to an incident count as critical. They go to Telegram and Slack, and are recorded as resolved after the actor confirms.
Result
The review cycle went from monthly to daily, and awareness of risky actions went from up to a month later to the same day. Review effort dropped to effectively zero.
What I learned
Defining the signals that lead to incidents, and never missing them, matters more than analysis after the fact. Without authority, "I tried this and it got better" persuades more than "we should do this".