Enable network and edge logging (LB, WAF, firewall, DNS)

Load balancers, web firewalls, network firewalls and DNS are the junction points every request to your applications passes through. Without logs, those junction points are black boxes: when a customer disputes a transaction, when a security tool flags suspicious traffic, when an auditor asks for a year of access records, you have aggregate counters and nothing else. This cluster of findings flags devices where that trail is missing.

The cost of fixing it is small and predictable, and it is storage, not a per-feature charge. Load balancer logs go to S3 and run well under ten dollars a month per balancer once a lifecycle rule tiers them to cheaper storage; WAF and firewall logs go to CloudWatch, S3 or Firehose at a few dollars a month, less if you filter to blocked traffic; Route 53 query logs are roughly a few dollars a month even for a busy zone. The cost of the missing logs is invisible until it isn't: a single dispute or incident that stalls for want of a request trail costs far more than a year of tiered storage.

From a governance standpoint this is a compliance and evidence requirement, not a cost-optimisation one. PCI DSS section 10 expects access logging on internet-facing services with audit-quality retention, and SOC 2, ISO 27001 and NIST 800-53 have parallel expectations. The right framing is cheap insurance against an expensive, contingent loss, and the only real decision is the retention period, which is where the modest ongoing cost actually lives.

Marco brings the cluster of edge-logging findings to his finance partner because the report spans load balancers, a WAF web ACL, the egress firewall and several public hosted zones, and he wants the storage sized before he turns anything on. The partner's read on cost is reassuring: this is storage, not a per-feature charge. Load balancer logs go to S3 and run well under ten dollars a month per balancer once a lifecycle rule tiers them to cheaper storage; WAF and firewall logs are a few dollars a month, less if filtered to blocked traffic; Route 53 query logs are roughly a few dollars even for a busy zone. Both volume and retention are knowable in advance, so the partner can model it once and set it as a standing budget line rather than re-litigating it every time the storage bill ticks up.

What the partner cares about is the regulatory exposure, which is the higher-stakes item. PCI DSS section 10 expects access logging on internet-facing services with audit-quality retention, and SOC 2, ISO 27001 and NIST 800-53 carry parallel expectations. A load balancer in front of a payment flow, a WAF on a customer portal or a public DNS zone without logging is a finding the moment an auditor asks, and a single dispute or incident that stalls for want of a request trail costs far more than a year of tiered storage. The partner's instruction is precise: turn logging on, set retention to the longest obligation in scope, and use filters and lifecycle tiering so cost stays flat as traffic grows.

The cost side of edge logging is one of the most predictable line items in cloud security. Storage is a function of traffic volume and retention period, both knowable in advance, and lifecycle tiering keeps per-device cost flat regardless of traffic growth. Even busy load balancers, web ACLs and DNS zones rarely exceed single-digit to low-double-digit dollars a month each under a sensible retention policy. The finance ask is to model it once, set it as a standing budget line, and stop re-litigating it every time the storage bill ticks up.

The regulatory exposure is the higher-stakes item. PCI DSS section 10 requires logging access to in-scope environments and retaining the logs (commonly a year); SOC 2, ISO 27001 and NIST have parallel expectations on internet-facing services. A load balancer in front of a payment flow, a WAF on a customer portal, a firewall on the cardholder-data perimeter, or a public DNS zone without logging is a finding the moment an auditor asks. The remediation cost is a few dollars of storage; the alternative is a finding that blocks a certification renewal.

The asymmetry is the point. The total cost of logging every internet-facing device in a typical environment is less than the cost of a single engineer-hour spent reconstructing an incident from counters, and far less than a stalled investigation or a widened breach-notification scope. Finance's role is to make that asymmetry visible so the decision is taken before the incident, not after, and to set retention to the longest requirement in scope rather than minimising it to save a few dollars and failing the audit anyway.

Every request to a public application crosses our DNS, a load balancer, a web firewall and a network firewall. This group of findings means some of those devices keep no record of the traffic they handled. Everything works day to day, until an auditor or a security investigation asks for the record and there isn't one.

This is a low-cost, high-consequence gap. Turning logging on is cheap and quick; the exposure of leaving it off only surfaces during an audit or a breach, exactly when a blind spot is least affordable. In regulated environments it is a hard compliance requirement, not a nice-to-have.

The leadership question is whether every internet-facing device logs by default, with retention matched to our obligations, so an incident response engagement never starts with "we have no record of the attack window."

The edge-logging findings reached the executive review after a credential-stuffing wave during a holiday sale: the WAF rate-based rule blocked the bulk of it, but logging was never enabled on that web ACL, so the team had a blocked total and nothing else, no source IPs, no matched-rule detail, no way to separate caught customers from attackers, and no log line to hand the auditor. The lesson leadership drew was not about that one rule. It was that every request to a public application crosses DNS, a load balancer, a web firewall and a network firewall, and that some of those devices kept no record of the traffic they handled.

So the executive framing settled on two things. First, this is a low-cost, high-consequence gap: turning logging on is cheap and quick, but the exposure of leaving it off surfaces only during an audit or a breach, exactly when a blind spot is least affordable, and in regulated environments it is a hard requirement, not a nice-to-have. Second, the answer is to make edge logging a provisioning default everywhere, with retention matched to the longest compliance obligation, so an incident response engagement never starts with we have no record of the attack window. The metric leadership tracks is coverage, the percentage of internet-facing devices logging with compliant retention, not the finding count.

These controls span Low to High severity, but the dollar cost of fixing any of them is trivial, which is exactly why a persistent gap is worth attention: a near-free control being off signals that logging is being decided device by device rather than by default. The absence of edge logs does not change what your applications do, but it changes what you can prove and what you can investigate. A Low-severity finding that blocks a SOC 2 audit, or leaves a breach unscopeable, has a High-severity business consequence.

The downside is concentrated and reputational: the one time these matter is a security incident or a regulator's request for evidence, and "we have no record of what crossed our perimeter" is an answer no executive wants to give. The leadership move is to make edge logging a provisioning default everywhere, with retention matched to obligations, so the evidence is always there before anyone needs it. The metric worth tracking is coverage (the percentage of internet-facing devices logging with compliant retention) not the finding count.