Secrets manager access logged with audit trail

Without secrets manager audit logs, you cannot answer the most critical post-breach question: which secrets were accessed, by whom, and when? CWE-778 (Insufficient Logging) and OWASP A09 (Security Logging and Monitoring Failures) both identify missing audit trails as a security failure. NIST AU-2 requires that organizations define events to be logged — secrets retrieval is the highest-priority event in that list. PCI-DSS 4.0 Req-10.2 mandates logging all access to audit logs themselves and cardholder data resources. Without these logs, incident response is blind, forensic timelines cannot be established, and compliance cannot be demonstrated.

Enable audit logging in your secrets manager and verify that each log entry captures at minimum: timestamp, principal identity, secret identifier, operation, and result code.

AWS Secrets Manager via CloudTrail:

aws cloudtrail create-trail \
  --name secrets-audit-trail \
  --s3-bucket-name your-audit-bucket
aws cloudtrail start-logging --name secrets-audit-trail

HashiCorp Vault — add to vault.hcl:

audit "file" {
  path = "/vault/logs/audit.log"
}

Azure Key Vault: Portal → Key Vault → Diagnostic settings → Add diagnostic setting → enable AuditEvent → send to Log Analytics workspace.

After enabling, verify by retrieving a secret and confirming the retrieval appears in the audit log within 60 seconds.