Using Cloud Audit Logging with Cloud Build

The page describes the audit logs created by Cloud Build.

Audit logging summary

Google Cloud Platform services write audit logs to help you answer the questions of "who did what, where, and when?" within your Google Cloud Platform projects and organizations.

Audited information is divided into different categories of information:

  • Admin Activity: Operations that modify the configuration or metadata of a Cloud Build resource. Any API call that creates or cancels a build, and creates, deletes, enables, disables, or updates a trigger falls into this category. This audit information is provided by default.

  • Data Access (ADMIN_READ): Operations that read the configuration or metadata of a project, build, or a trigger. This audit information is not provided by default.

  • Data Access (DATA_READ): Operations that read user-provided data from a resource. This audit information is not provided by default.

  • Data Access (DATA_WRITE): Operations that write user-provided data to a resource. This audit information is not provided by default.

For more information, see Cloud Audit Logging.

Audited operations

The following table summarizes which Cloud Build API operations are listed in each audit log category:

Audit logs category Cloud Build Operations
Admin activity
  • projects.builds.create
  • projects.builds.cancel
  • projects.triggers.create
  • projects.triggers.delete
  • projects.triggers.update
  • Running triggers using the Run Trigger button in the Google Cloud Platform Console
  • Creating/updating IAM policies
Data access (ADMIN_READ)
  • projects.builds.get
  • projects.builds.list
  • projects.triggers.list
  • projects.triggers.get
  • Getting IAM policies
Data access (DATA_READ) None
Data access (DATA_WRITE) None

Unlike audit logs for other services, Cloud Build only has ADMIN_READ data access logs and does not offer DATA_READ and DATA_WRITE logs. This is because DATA_READ and DATA_WRITE logs are only used for services that store and manage user data, and Cloud Build considers builds and triggers to be administrative config information.

Permissions for accessing the logs

The following users can view admin activity logs:

The following users can view data access logs:

  • Project owners.
  • Users with the Private Logs Viewer IAM role.
  • Users with the logging.privateLogEntries.list IAM permission.

For instructions on granting IAM permissions, see Configuring Access Control.

Audit log format

Audit log entries have the following structure:

  • An object of type LogEntry that contains the entire log entry.
  • An object of type AuditLog that is held in the protoPayload field of the LogEntry object.

Knowing what information is held in these objects will help you understand and retrieve your audit log entries using the Logs Viewer and the Stackdriver Logging API.

All audit log entries contain the name of an audit log, a resource, and a service:

  • logName: This field will indicate whether the log is an Admin Activity or Data Access audit log. For example:

    projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Factivity
    projects/[PROJECT_ID]/logs/cloudaudit.googleapis.com%2Fdata_access
    organizations/[ORGANIZATION_ID]/logs/cloudaudit.googleapis.com%2Factivity
    organizations/[ORGANIZATION_ID]/logs/cloudaudit.googleapis.com%2Fdata_access
    

    Within a project or organization, these log names are suffixed with the abbreviated activity or data_access.

  • Monitored resource type:

    • build: Includes the project, build, and build trigger for the audited operation.
  • serviceName: For Cloud Build, the field will contain cloudbuild.googleapis.com.

    Resource types belongs to a single service, but a service can have several resource types. For a list of services and resources, see Mapping services to resources.

For more details, see Audit Log Datatypes.

Enabling logs

Admin activity logs are enabled and logged by default. These logs do not count towards your log ingestion quota.

Data access logs for Cloud Build operations are not recorded by default. You can configure Data Access audit logs in your project or organization. To learn how to enable logs for data access-type operations, see Configuring Data Access Logs.

Quotas and limits

Admin Activity logs do not count towards your log ingestion quota.

Data access operations are high volume and count toward your log ingestion quota.

For more information, see Quotas and Limits.

Viewing logs

To view a summary of your Admin Activity:

To select and filter your logs and view them in detail:

  1. Open the Logs Viewer page:

    Go to the Logs Viewer page

  2. In the first drop-down menu, select the resource whose audit logs you wish to see. Select a specific project or "all projects."

  3. In the second menu, select the log name you want to see: activity for Admin Activity audit logs and data_access for Data Access audit logs (if the logs are available).

The audit logs appear in the Logs Viewer.

You can also use the Logs Viewer advanced filter interface to specify the resource type and log name. For more information, see Retrieving audit logs.

Exporting your audit logs

You can export copies of some or all of your logs to other applications, other repositories, or third parties. To export your logs, see Exporting logs.

An organization can create an aggregated export sink that can export log entries from all the projects, folders, and billing accounts of the organization. Like any sink, your aggregated export sink contains a filter that selects individual log entries. To aggregate and export your audit logs, see Choosing audit logs.

To read your log entries through the API, see entries.list. To read your log entries using the SDK, see Reading log entries.

Next steps

Was this page helpful? Let us know how we did:

Send feedback about...

Cloud Build