Cloud Asset Inventory audit logging

This document describes audit logging for Cloud Asset Inventory. Google Cloud services write audit logs that record administrative activities and accesses within your Google Cloud resources. For more information, see Cloud Audit Logs overview.

This page was last generated on 2024-05-21 18:28:27 UTC.

Service name

Cloud Asset Inventory audit logs use the service name cloudasset.googleapis.com.

Methods by permission type

Methods that check DATA_READ, DATA_WRITE, and ADMIN_READ permission types are Data Access audit logs. Methods that check ADMIN_WRITE permission types are Admin Activity audit logs.

Permission type	Methods
ADMIN_READ	AnalyzeMove google.cloud.asset.v1.AssetService.AnalyzeIamPolicy google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning google.cloud.asset.v1.AssetService.AnalyzeOrgPolicies google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedAssets google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedContainers google.cloud.asset.v1.AssetService.BatchGetAssetsHistory google.cloud.asset.v1.AssetService.BatchGetEffectiveIamPolicies google.cloud.asset.v1.AssetService.ExportAssets google.cloud.asset.v1.AssetService.GetFeed google.cloud.asset.v1.AssetService.GetSavedQuery google.cloud.asset.v1.AssetService.ListAssets google.cloud.asset.v1.AssetService.ListFeeds google.cloud.asset.v1.AssetService.ListSavedQueries google.cloud.asset.v1.AssetService.QueryAssets google.cloud.asset.v1.AssetService.SearchAllIamPolicies google.cloud.asset.v1.AssetService.SearchAllResources google.cloud.asset.v1beta1.AssetService.BatchGetAssetsHistory google.cloud.asset.v1beta1.AssetService.ExportAssets google.cloud.asset.v1p1beta1.AssetService.SearchAllIamPolicies google.cloud.asset.v1p1beta1.AssetService.SearchAllResources google.cloud.asset.v1p2beta1.AssetService.GetFeed google.cloud.asset.v1p2beta1.AssetService.ListFeeds google.cloud.asset.v1p5beta1.AssetService.ListAssets google.cloud.asset.v1p7beta1.AssetService.ExportAssets
ADMIN_WRITE	google.cloud.asset.v1.AssetService.CreateFeed google.cloud.asset.v1.AssetService.CreateSavedQuery google.cloud.asset.v1.AssetService.DeleteFeed google.cloud.asset.v1.AssetService.DeleteSavedQuery google.cloud.asset.v1.AssetService.UpdateFeed google.cloud.asset.v1.AssetService.UpdateSavedQuery google.cloud.asset.v1p2beta1.AssetService.CreateFeed google.cloud.asset.v1p2beta1.AssetService.DeleteFeed google.cloud.asset.v1p2beta1.AssetService.UpdateFeed

Permission type

Methods

ADMIN_READ

AnalyzeMove
google.cloud.asset.v1.AssetService.AnalyzeIamPolicy
google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning
google.cloud.asset.v1.AssetService.AnalyzeOrgPolicies
google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedAssets
google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedContainers
google.cloud.asset.v1.AssetService.BatchGetAssetsHistory
google.cloud.asset.v1.AssetService.BatchGetEffectiveIamPolicies
google.cloud.asset.v1.AssetService.ExportAssets
google.cloud.asset.v1.AssetService.GetFeed
google.cloud.asset.v1.AssetService.GetSavedQuery
google.cloud.asset.v1.AssetService.ListAssets
google.cloud.asset.v1.AssetService.ListFeeds
google.cloud.asset.v1.AssetService.ListSavedQueries
google.cloud.asset.v1.AssetService.QueryAssets
google.cloud.asset.v1.AssetService.SearchAllIamPolicies
google.cloud.asset.v1.AssetService.SearchAllResources
google.cloud.asset.v1beta1.AssetService.BatchGetAssetsHistory
google.cloud.asset.v1beta1.AssetService.ExportAssets
google.cloud.asset.v1p1beta1.AssetService.SearchAllIamPolicies
google.cloud.asset.v1p1beta1.AssetService.SearchAllResources
google.cloud.asset.v1p2beta1.AssetService.GetFeed
google.cloud.asset.v1p2beta1.AssetService.ListFeeds
google.cloud.asset.v1p5beta1.AssetService.ListAssets
google.cloud.asset.v1p7beta1.AssetService.ExportAssets

ADMIN_WRITE

google.cloud.asset.v1.AssetService.CreateFeed
google.cloud.asset.v1.AssetService.CreateSavedQuery
google.cloud.asset.v1.AssetService.DeleteFeed
google.cloud.asset.v1.AssetService.DeleteSavedQuery
google.cloud.asset.v1.AssetService.UpdateFeed
google.cloud.asset.v1.AssetService.UpdateSavedQuery
google.cloud.asset.v1p2beta1.AssetService.CreateFeed
google.cloud.asset.v1p2beta1.AssetService.DeleteFeed
google.cloud.asset.v1p2beta1.AssetService.UpdateFeed

Audit logs per API interface

For information about which permissions are evaluated and how for each method, see the Identity and Access Management documentation for Cloud Asset Inventory.

google.cloud.asset.v1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1.AssetService.

AnalyzeMove

Method: AnalyzeMove
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeMove - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="AnalyzeMove"

google.cloud.asset.v1.AssetService.AnalyzeIamPolicy

Method: google.cloud.asset.v1.AssetService.AnalyzeIamPolicy
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeIamPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.AnalyzeIamPolicy"

google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning

Method: google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeIamPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: Long Running Operation
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.AnalyzeIamPolicyLongrunning"

google.cloud.asset.v1.AssetService.AnalyzeOrgPolicies

Method: google.cloud.asset.v1.AssetService.AnalyzeOrgPolicies
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeOrgPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.AnalyzeOrgPolicies"

google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedAssets

Method: google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedAssets
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeOrgPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedAssets"

google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedContainers

Method: google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedContainers
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeOrgPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.AnalyzeOrgPolicyGovernedContainers"

google.cloud.asset.v1.AssetService.BatchGetAssetsHistory

Method: google.cloud.asset.v1.AssetService.BatchGetAssetsHistory
Audit log Type: Data Access
Permissions:
- cloudasset.assets.exportAccessPolicy - ADMIN_READ
- cloudasset.assets.exportIamPolicy - ADMIN_READ
- cloudasset.assets.exportOSInventories - ADMIN_READ
- cloudasset.assets.exportOrgPolicy - ADMIN_READ
- cloudasset.assets.exportResource - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.BatchGetAssetsHistory"

google.cloud.asset.v1.AssetService.BatchGetEffectiveIamPolicies

Method: google.cloud.asset.v1.AssetService.BatchGetEffectiveIamPolicies
Audit log Type: Data Access
Permissions:
- cloudasset.assets.analyzeIamPolicy - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.BatchGetEffectiveIamPolicies"

google.cloud.asset.v1.AssetService.CreateFeed

Method: google.cloud.asset.v1.AssetService.CreateFeed
Audit log Type: Admin Activity
Permissions:See IAM documentation for permissions.
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.CreateFeed"

google.cloud.asset.v1.AssetService.CreateSavedQuery

Method: google.cloud.asset.v1.AssetService.CreateSavedQuery
Audit log Type: Admin Activity
Permissions:
- cloudasset.savedqueries.create - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.CreateSavedQuery"

google.cloud.asset.v1.AssetService.DeleteFeed

Method: google.cloud.asset.v1.AssetService.DeleteFeed
Audit log Type: Admin Activity
Permissions:
- cloudasset.feeds.delete - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.DeleteFeed"

google.cloud.asset.v1.AssetService.DeleteSavedQuery

Method: google.cloud.asset.v1.AssetService.DeleteSavedQuery
Audit log Type: Admin Activity
Permissions:
- cloudasset.savedqueries.delete - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.DeleteSavedQuery"

google.cloud.asset.v1.AssetService.ExportAssets

Method: google.cloud.asset.v1.AssetService.ExportAssets
Audit log Type: Data Access
Permissions:See IAM documentation for permissions.
Method is a Long Running Operation or Streaming: Long Running Operation
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.ExportAssets"

google.cloud.asset.v1.AssetService.GetFeed

Method: google.cloud.asset.v1.AssetService.GetFeed
Audit log Type: Data Access
Permissions:
- cloudasset.feeds.get - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.GetFeed"

google.cloud.asset.v1.AssetService.GetSavedQuery

Method: google.cloud.asset.v1.AssetService.GetSavedQuery
Audit log Type: Data Access
Permissions:
- cloudasset.savedqueries.get - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.GetSavedQuery"

google.cloud.asset.v1.AssetService.ListAssets

Method: google.cloud.asset.v1.AssetService.ListAssets
Audit log Type: Data Access
Permissions:See IAM documentation for permissions.
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.ListAssets"

google.cloud.asset.v1.AssetService.ListFeeds

Method: google.cloud.asset.v1.AssetService.ListFeeds
Audit log Type: Data Access
Permissions:
- cloudasset.feeds.list - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.ListFeeds"

google.cloud.asset.v1.AssetService.ListSavedQueries

Method: google.cloud.asset.v1.AssetService.ListSavedQueries
Audit log Type: Data Access
Permissions:
- cloudasset.savedqueries.list - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.ListSavedQueries"

google.cloud.asset.v1.AssetService.QueryAssets

Method: google.cloud.asset.v1.AssetService.QueryAssets
Audit log Type: Data Access
Permissions:
- cloudasset.assets.queryAccessPolicy - ADMIN_READ
- cloudasset.assets.queryIamPolicy - ADMIN_READ
- cloudasset.assets.queryOSInventories - ADMIN_READ
- cloudasset.assets.queryResource - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.QueryAssets"

google.cloud.asset.v1.AssetService.SearchAllIamPolicies

Method: google.cloud.asset.v1.AssetService.SearchAllIamPolicies
Audit log Type: Data Access
Permissions:
- cloudasset.assets.searchAllIamPolicies - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.SearchAllIamPolicies"

google.cloud.asset.v1.AssetService.SearchAllResources

Method: google.cloud.asset.v1.AssetService.SearchAllResources
Audit log Type: Data Access
Permissions:See IAM documentation for permissions.
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.SearchAllResources"

google.cloud.asset.v1.AssetService.UpdateFeed

Method: google.cloud.asset.v1.AssetService.UpdateFeed
Audit log Type: Admin Activity
Permissions:
- cloudasset.assets.exportResource - ADMIN_READ
- cloudasset.feeds.update - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.UpdateFeed"

google.cloud.asset.v1.AssetService.UpdateSavedQuery

Method: google.cloud.asset.v1.AssetService.UpdateSavedQuery
Audit log Type: Admin Activity
Permissions:
- cloudasset.savedqueries.update - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1.AssetService.UpdateSavedQuery"

google.cloud.asset.v1beta1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1beta1.AssetService.

google.cloud.asset.v1beta1.AssetService.BatchGetAssetsHistory

Method: google.cloud.asset.v1beta1.AssetService.BatchGetAssetsHistory
Audit log Type: Data Access
Permissions:
- cloudasset.assets.exportResource - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1beta1.AssetService.BatchGetAssetsHistory"

google.cloud.asset.v1beta1.AssetService.ExportAssets

Method: google.cloud.asset.v1beta1.AssetService.ExportAssets
Audit log Type: Data Access
Permissions:
- cloudasset.assets.exportResource - ADMIN_READ
Method is a Long Running Operation or Streaming: Long Running Operation
Filter for this method: protoPayload.methodName="google.cloud.asset.v1beta1.AssetService.ExportAssets"

google.cloud.asset.v1p1beta1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1p1beta1.AssetService.

google.cloud.asset.v1p1beta1.AssetService.SearchAllIamPolicies

Method: google.cloud.asset.v1p1beta1.AssetService.SearchAllIamPolicies
Audit log Type: Data Access
Permissions:
- cloudasset.assets.searchAllIamPolicies - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p1beta1.AssetService.SearchAllIamPolicies"

google.cloud.asset.v1p1beta1.AssetService.SearchAllResources

Method: google.cloud.asset.v1p1beta1.AssetService.SearchAllResources
Audit log Type: Data Access
Permissions:
- cloudasset.assets.searchAllResources - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p1beta1.AssetService.SearchAllResources"

google.cloud.asset.v1p2beta1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1p2beta1.AssetService.

google.cloud.asset.v1p2beta1.AssetService.CreateFeed

Method: google.cloud.asset.v1p2beta1.AssetService.CreateFeed
Audit log Type: Admin Activity
Permissions:
- cloudasset.assets.exportResource - ADMIN_READ
- cloudasset.feeds.create - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p2beta1.AssetService.CreateFeed"

google.cloud.asset.v1p2beta1.AssetService.DeleteFeed

Method: google.cloud.asset.v1p2beta1.AssetService.DeleteFeed
Audit log Type: Admin Activity
Permissions:
- cloudasset.feeds.delete - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p2beta1.AssetService.DeleteFeed"

google.cloud.asset.v1p2beta1.AssetService.GetFeed

Method: google.cloud.asset.v1p2beta1.AssetService.GetFeed
Audit log Type: Data Access
Permissions:
- cloudasset.feeds.get - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p2beta1.AssetService.GetFeed"

google.cloud.asset.v1p2beta1.AssetService.ListFeeds

Method: google.cloud.asset.v1p2beta1.AssetService.ListFeeds
Audit log Type: Data Access
Permissions:
- cloudasset.feeds.list - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p2beta1.AssetService.ListFeeds"

google.cloud.asset.v1p2beta1.AssetService.UpdateFeed

Method: google.cloud.asset.v1p2beta1.AssetService.UpdateFeed
Audit log Type: Admin Activity
Permissions:
- cloudasset.feeds.update - ADMIN_WRITE
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p2beta1.AssetService.UpdateFeed"

google.cloud.asset.v1p5beta1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1p5beta1.AssetService.

google.cloud.asset.v1p5beta1.AssetService.ListAssets

Method: google.cloud.asset.v1p5beta1.AssetService.ListAssets
Audit log Type: Data Access
Permissions:
- cloudasset.assets.listComputeNetworks - ADMIN_READ
- cloudasset.assets.listIamPolicy - ADMIN_READ
- cloudasset.assets.listResource - ADMIN_READ
- cloudasset.assets.listStorageBuckets - ADMIN_READ
Method is a Long Running Operation or Streaming: No.
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p5beta1.AssetService.ListAssets"

google.cloud.asset.v1p7beta1.AssetService

Details about audit logs associated with methods belonging to google.cloud.asset.v1p7beta1.AssetService.

google.cloud.asset.v1p7beta1.AssetService.ExportAssets

Method: google.cloud.asset.v1p7beta1.AssetService.ExportAssets
Audit log Type: Data Access
Permissions:
- cloudasset.assets.exportCloudresourcemanagerProjects - ADMIN_READ
- cloudasset.assets.exportIamPolicy - ADMIN_READ
- cloudasset.assets.exportResource - ADMIN_READ
Method is a Long Running Operation or Streaming: Long Running Operation
Filter for this method: protoPayload.methodName="google.cloud.asset.v1p7beta1.AssetService.ExportAssets"

Methods that don't produce audit logs

Generally methods don't produce audit logs because they are high volume and doing so would be very expensive, or because the method has low auditing value, or because another audit or platform log already provides coverage for what the method does.

The following methods don't produce audit logs:

google.longrunning.Operations.GetOperation