How does investigating an incident in a cloud environment differ from on premises?

The control plane becomes the primary crime scene. Instead of disk and memory on a fixed host, your best evidence is the API audit log: which identity called what, from where, with which credentials. Instances are ephemeral, so snapshot before terminating. Identity is the perimeter, so trace roles, temporary credentials and privilege escalation paths rather than network position, and expect shared responsibility to limit some telemetry.

The biggest shift is that the control plane is where the incident actually happens. On premises I would grab memory and disk from a host. In cloud my first pull is the API audit log, because it tells me which identity called which action from which source address, and whether it used a long lived key or an assumed role with temporary credentials. Ephemerality is the second difference: an instance can be gone before I reach it, so my first containment action is to snapshot the volume and capture memory if the tooling allows, then isolate with a restrictive security group rather than terminating, because terminating destroys my evidence. Third, escalation paths look different. I am chasing role trust policies, over permissive identity policies and instance metadata access rather than domain administrator. And I stay honest about the boundary: below the hypervisor I get no telemetry, so if I need it I have to request it through a formal provider process, which is slow, and I plan around that.