You should check out the work by Keyun Ruan.

Lots of suggestions in previous Q&A

https://www.researchgate.net/profile/Keyun_Ruan

https://www.researchgate.net/post/cloud_forensic_its_tools

https://www.researchgate.net/post/What_are_the_existing_Cloud_forensic_frameworks2

https://www.researchgate.net/post/How_cloud_storage_forensics_can_be_done

just think server forensics. whatever tools you can use for collecting evidence from a client server environment can be used (I am generalising) to cloud environments. in the UK there is a policy that if something is on the monitor of the suspect then it is included in the scene and the jurisdiction of the OIC of the case. additionally, you have to include live forensics tools and techniques as well to complement and support your server forensic tools and techniques.

Generally speaking there are no such tools.   Lets consider the vague idea pf Google.   Hypothetically your organization uses Google for everything,    Something bad happens.   Its not as if Google will escort you into their data center ( which, of course, does not exist as The Datacenter ) and allow you to engage in packet traces, hard drive forensics, or view their back end logging facilities.   Most of these ideas are meaningless.  You are, in fact, at the mercy of Google to have bothered to instrument their services to enable retrospective analysis after a security incident.   Even in extremely high profile cases - such as the US election cycle - the data available was very limited.  Hence the vague idea of "russian hackers" and other nonsense.

Superfluous logging is incredibly expensive in the cloud - and all logging is superfluous until you need it.   Non-repudiation logging in real time is made difficult by the requirement for physical diversity and synchronous updates.

So there is no correct answer.  It varies from service to service.   Nor is there a integrated or universally agreed upon API for 3rd party monitoring systems to hook.  

The google approach is to take a end user centric, personal information centric ecosystem and plaster over the cracks with an administrative layer.  But behind the scenes you are using YouTube or GMail which is to say, it is not rigged for any deep level of forensic analysis - the other billion end users don't care and will never look at it.  Its designed for them, not us.

Take, for example, the Google Worm of late.   Google was able to stop the worm by unilaterally removing user's rights, and killing the app.   Hooray! 

When you look at the user's audit logs you see all of their user initiated authorization and de authorization activity.   You do NOT see Google's de-authorization activity.   This means that already Google is not providing a true and complete audit log.  

This would be like a Bank keeping a journal only for customer initiated deposits and withdraws.   When the customer comes in and claims money is missing, then what?   "Oh, the teller may have taken the money, but that's OK, they work for the bank."

This does not mean it can't be done, but when a service supporting billions of accounts is so poorly constructed, from a forensic standpoint, it does not bode well.   We have some services which provide much better ( e.g. complete, secure ) logging facilities.  But these are few and far between.

If as an admin I cannot tell if Google staff made changes to the security and authorization settings on a user's behalf, you have no audit.   And while you know what can be seen in plain sight, you have no means to independently verify anything the vendor says.