Identity and Access Management audit logging

This document describes audit logging for Identity and Access Management. Google Cloud services generate audit logs that record administrative and access activities within your Google Cloud resources. For more information about Cloud Audit Logs, see the following:

Notes

You can also view examples of audit log entries for service accounts.

Service name

Identity and Access Management audit logs use the service name iam.googleapis.com. Filter for this service:

    protoPayload.serviceName="iam.googleapis.com"
  

Methods by permission type

Each IAM permission has a type property, whose value is an enum that can be one of four values: ADMIN_READ, ADMIN_WRITE, DATA_READ, or DATA_WRITE. When you call a method, Identity and Access Management generates an audit log whose category is dependent on the type property of the permission required to perform the method. Methods that require an IAM permission with the type property value of DATA_READ, DATA_WRITE, or ADMIN_READ generate Data Access audit logs. Methods that require an IAM permission with the type property value of ADMIN_WRITE generate Admin Activity audit logs.

Permission type Methods
ADMIN_READ google.iam.admin.v1.GetIAMPolicy
google.iam.admin.v1.GetRole
google.iam.admin.v1.GetServiceAccount
google.iam.admin.v1.GetServiceAccountKey
google.iam.admin.v1.ListRoles
google.iam.admin.v1.ListServiceAccountKeys
google.iam.admin.v1.ListServiceAccounts
google.iam.admin.v1.OauthClients.GetOauthClient
google.iam.admin.v1.OauthClients.GetOauthClientCredential
google.iam.admin.v1.OauthClients.ListOauthClientCredentials
google.iam.admin.v1.OauthClients.ListOauthClients
google.iam.admin.v1.TestIAMPermissions
google.iam.admin.v1.WorkforcePools.GetIamPolicy
google.iam.admin.v1.WorkforcePools.GetWorkforcePool
google.iam.admin.v1.WorkforcePools.GetWorkforcePoolProvider
google.iam.admin.v1.WorkforcePools.GetWorkforcePoolProviderKey
google.iam.admin.v1.WorkforcePools.ListWorkforcePoolProviderKeys
google.iam.admin.v1.WorkforcePools.ListWorkforcePoolProviders
google.iam.admin.v1.WorkforcePools.ListWorkforcePools
google.iam.v1.WorkloadIdentityPools.GetWorkloadIdentityPool
google.iam.v1.WorkloadIdentityPools.GetWorkloadIdentityPoolProvider
google.iam.v1.WorkloadIdentityPools.GetWorkloadIdentityPoolProviderKey
google.iam.v1.WorkloadIdentityPools.ListWorkloadIdentityPoolProviderKeys
google.iam.v1.WorkloadIdentityPools.ListWorkloadIdentityPoolProviders
google.iam.v1.WorkloadIdentityPools.ListWorkloadIdentityPools
google.iam.v1beta.WorkloadIdentityPools.GetWorkloadIdentityPool
google.iam.v1beta.WorkloadIdentityPools.GetWorkloadIdentityPoolProvider
google.iam.v1beta.WorkloadIdentityPools.ListWorkloadIdentityPoolProviders
google.iam.v1beta.WorkloadIdentityPools.ListWorkloadIdentityPools
google.iam.v2.Policies.GetPolicy
google.iam.v2.Policies.ListPolicies
google.iam.v2alpha.Policies.GetPolicy
google.iam.v2alpha.Policies.ListPolicies
google.iam.v2beta.Policies.GetPolicy
google.iam.v2beta.Policies.ListPolicies
ADMIN_WRITE google.iam.admin.v1.CreateRole
google.iam.admin.v1.CreateServiceAccount
google.iam.admin.v1.CreateServiceAccountKey
google.iam.admin.v1.DeleteRole
google.iam.admin.v1.DeleteServiceAccount
google.iam.admin.v1.DeleteServiceAccountKey
google.iam.admin.v1.DisableServiceAccount
google.iam.admin.v1.DisableServiceAccountKey
google.iam.admin.v1.EnableServiceAccount
google.iam.admin.v1.EnableServiceAccountKey
google.iam.admin.v1.OauthClients.CreateOauthClient
google.iam.admin.v1.OauthClients.CreateOauthClientCredential
google.iam.admin.v1.OauthClients.DeleteOauthClient
google.iam.admin.v1.OauthClients.DeleteOauthClientCredential
google.iam.admin.v1.OauthClients.UndeleteOauthClient
google.iam.admin.v1.OauthClients.UpdateOauthClient
google.iam.admin.v1.OauthClients.UpdateOauthClientCredential
google.iam.admin.v1.PatchServiceAccount
google.iam.admin.v1.SetIAMPolicy
google.iam.admin.v1.UndeleteRole
google.iam.admin.v1.UndeleteServiceAccount
google.iam.admin.v1.UpdateRole
google.iam.admin.v1.UpdateServiceAccount
google.iam.admin.v1.UploadServiceAccountKey
google.iam.admin.v1.WorkforcePools.CreateWorkforcePool
google.iam.admin.v1.WorkforcePools.CreateWorkforcePoolProvider
google.iam.admin.v1.WorkforcePools.CreateWorkforcePoolProviderKey
google.iam.admin.v1.WorkforcePools.DeleteWorkforcePool
google.iam.admin.v1.WorkforcePools.DeleteWorkforcePoolProvider
google.iam.admin.v1.WorkforcePools.DeleteWorkforcePoolProviderKey
google.iam.admin.v1.WorkforcePools.DeleteWorkforcePoolSubject
google.iam.admin.v1.WorkforcePools.SetIamPolicy
google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePool
google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePoolProvider
google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePoolProviderKey
google.iam.admin.v1.WorkforcePools.UndeleteWorkforcePoolSubject
google.iam.admin.v1.WorkforcePools.UpdateWorkforcePool
google.iam.admin.v1.WorkforcePools.UpdateWorkforcePoolProvider
google.iam.v1.WorkloadIdentityPools.CreateWorkloadIdentityPool
google.iam.v1.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider
google.iam.v1.WorkloadIdentityPools.CreateWorkloadIdentityPoolProviderKey
google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPool
google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPoolProvider
google.iam.v1.WorkloadIdentityPools.DeleteWorkloadIdentityPoolProviderKey
google.iam.v1.WorkloadIdentityPools.UndeleteWorkloadIdentityPool
google.iam.v1.WorkloadIdentityPools.UndeleteWorkloadIdentityPoolProvider
google.iam.v1.WorkloadIdentityPools.UndeleteWorkloadIdentityPoolProviderKey
google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPool
google.iam.v1.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider
google.iam.v1beta.WorkloadIdentityPools.CreateWorkloadIdentityPool
google.iam.v1beta.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider
google.iam.v1beta.WorkloadIdentityPools.DeleteWorkloadIdentityPool
google.iam.v1beta.WorkloadIdentityPools.DeleteWorkloadIdentityPoolProvider
google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPool
google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPoolProvider
google.iam.v1beta.WorkloadIdentityPools.UpdateWorkloadIdentityPool
google.iam.v1beta.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider
google.iam.v2.Policies.CreatePolicy
google.iam.v2.Policies.DeletePolicy
google.iam.v2.Policies.UpdatePolicy
google.iam.v2alpha.Policies.CreatePolicy
google.iam.v2alpha.Policies.DeletePolicy
google.iam.v2alpha.Policies.UpdatePolicy
google.iam.v2beta.Policies.CreatePolicy
google.iam.v2beta.Policies.DeletePolicy
google.iam.v2beta.Policies.UpdatePolicy
OTHER google.iam.admin.v1.QueryGrantableRoles: To enable this log, enable ADMIN_READ under the service cloudresourcemanager.googleapis.com.

API interface audit logs

For information about how and which permissions are evaluated for each method, see the Identity and Access Management documentation for Identity and Access Management.

google.iam.admin.v1.IAM

The following audit logs are associated with methods belonging to google.iam.admin.v1.IAM.

CreateRole

  • Method: google.iam.admin.v1.CreateRole
  • Audit log type: Admin activity
  • Permissions:
    • iam.roles.create - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.CreateRole"

CreateServiceAccount

  • Method: google.iam.admin.v1.CreateServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.create - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.CreateServiceAccount"

CreateServiceAccountKey

  • Method: google.iam.admin.v1.CreateServiceAccountKey
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccountKeys.create - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.CreateServiceAccountKey"

DeleteRole

  • Method: google.iam.admin.v1.DeleteRole
  • Audit log type: Admin activity
  • Permissions:
    • iam.roles.delete - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.DeleteRole"

DeleteServiceAccount

  • Method: google.iam.admin.v1.DeleteServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.delete - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.DeleteServiceAccount"

DeleteServiceAccountKey

  • Method: google.iam.admin.v1.DeleteServiceAccountKey
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccountKeys.delete - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.DeleteServiceAccountKey"

DisableServiceAccount

  • Method: google.iam.admin.v1.DisableServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.disable - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.DisableServiceAccount"

DisableServiceAccountKey

  • Method: google.iam.admin.v1.DisableServiceAccountKey
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccountKeys.disable - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.DisableServiceAccountKey"

EnableServiceAccount

  • Method: google.iam.admin.v1.EnableServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.enable - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.EnableServiceAccount"

EnableServiceAccountKey

  • Method: google.iam.admin.v1.EnableServiceAccountKey
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccountKeys.enable - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.EnableServiceAccountKey"

GetIAMPolicy

  • Method: google.iam.admin.v1.GetIAMPolicy
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccounts.getIamPolicy - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.GetIAMPolicy"

GetRole

  • Method: google.iam.admin.v1.GetRole
  • Audit log type: Data access
  • Permissions:
    • iam.roles.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.GetRole"

GetServiceAccount

  • Method: google.iam.admin.v1.GetServiceAccount
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccounts.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.GetServiceAccount"

GetServiceAccountKey

  • Method: google.iam.admin.v1.GetServiceAccountKey
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccountKeys.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.GetServiceAccountKey"

ListRoles

  • Method: google.iam.admin.v1.ListRoles
  • Audit log type: Data access
  • Permissions:
    • iam.roles.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.ListRoles"

ListServiceAccountKeys

  • Method: google.iam.admin.v1.ListServiceAccountKeys
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccountKeys.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.ListServiceAccountKeys"

ListServiceAccounts

  • Method: google.iam.admin.v1.ListServiceAccounts
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccounts.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.ListServiceAccounts"

PatchServiceAccount

  • Method: google.iam.admin.v1.PatchServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.update - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.PatchServiceAccount"

QueryGrantableRoles

  • Method: google.iam.admin.v1.QueryGrantableRoles
  • Audit log type: Data access
  • Permissions:
    • resourcemanager.projects.getIamPolicy - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.QueryGrantableRoles"

SetIAMPolicy

  • Method: google.iam.admin.v1.SetIAMPolicy
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.setIamPolicy - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.SetIAMPolicy"

TestIAMPermissions

  • Method: google.iam.admin.v1.TestIAMPermissions
  • Audit log type: Data access
  • Permissions:
    • iam.serviceAccounts.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.TestIAMPermissions"

UndeleteRole

  • Method: google.iam.admin.v1.UndeleteRole
  • Audit log type: Admin activity
  • Permissions:
    • iam.roles.undelete - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.UndeleteRole"

UndeleteServiceAccount

  • Method: google.iam.admin.v1.UndeleteServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.undelete - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.UndeleteServiceAccount"

UpdateRole

  • Method: google.iam.admin.v1.UpdateRole
  • Audit log type: Admin activity
  • Permissions:
    • iam.roles.update - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.UpdateRole"

UpdateServiceAccount

  • Method: google.iam.admin.v1.UpdateServiceAccount
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccounts.update - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.UpdateServiceAccount"

UploadServiceAccountKey

  • Method: google.iam.admin.v1.UploadServiceAccountKey
  • Audit log type: Admin activity
  • Permissions:
    • iam.serviceAccountKeys.create - ADMIN_WRITE
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.UploadServiceAccountKey"

google.iam.admin.v1.OauthClients

The following audit logs are associated with methods belonging to google.iam.admin.v1.OauthClients.

CreateOauthClient

CreateOauthClientCredential

DeleteOauthClient

DeleteOauthClientCredential

GetOauthClient

GetOauthClientCredential

ListOauthClientCredentials

ListOauthClients

UndeleteOauthClient

UpdateOauthClient

UpdateOauthClientCredential

google.iam.admin.v1.WorkforcePools

The following audit logs are associated with methods belonging to google.iam.admin.v1.WorkforcePools.

CreateWorkforcePool

CreateWorkforcePoolProvider

CreateWorkforcePoolProviderKey

DeleteWorkforcePool

DeleteWorkforcePoolProvider

DeleteWorkforcePoolProviderKey

DeleteWorkforcePoolSubject

GetIamPolicy

  • Method: google.iam.admin.v1.WorkforcePools.GetIamPolicy
  • Audit log type: Data access
  • Permissions:
    • iam.workforcePools.getIamPolicy - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.admin.v1.WorkforcePools.GetIamPolicy"

GetWorkforcePool

GetWorkforcePoolProvider

GetWorkforcePoolProviderKey

ListWorkforcePoolProviderKeys

ListWorkforcePoolProviders

ListWorkforcePools

SetIamPolicy

UndeleteWorkforcePool

UndeleteWorkforcePoolProvider

UndeleteWorkforcePoolProviderKey

UndeleteWorkforcePoolSubject

UpdateWorkforcePool

UpdateWorkforcePoolProvider

google.iam.v1.WorkloadIdentityPools

The following audit logs are associated with methods belonging to google.iam.v1.WorkloadIdentityPools.

CreateWorkloadIdentityPool

CreateWorkloadIdentityPoolProvider

CreateWorkloadIdentityPoolProviderKey

DeleteWorkloadIdentityPool

DeleteWorkloadIdentityPoolProvider

DeleteWorkloadIdentityPoolProviderKey

GetWorkloadIdentityPool

GetWorkloadIdentityPoolProvider

GetWorkloadIdentityPoolProviderKey

ListWorkloadIdentityPoolProviderKeys

ListWorkloadIdentityPoolProviders

ListWorkloadIdentityPools

UndeleteWorkloadIdentityPool

UndeleteWorkloadIdentityPoolProvider

UndeleteWorkloadIdentityPoolProviderKey

UpdateWorkloadIdentityPool

UpdateWorkloadIdentityPoolProvider

google.iam.v1beta.WorkloadIdentityPools

The following audit logs are associated with methods belonging to google.iam.v1beta.WorkloadIdentityPools.

CreateWorkloadIdentityPool

CreateWorkloadIdentityPoolProvider

DeleteWorkloadIdentityPool

DeleteWorkloadIdentityPoolProvider

GetWorkloadIdentityPool

GetWorkloadIdentityPoolProvider

ListWorkloadIdentityPoolProviders

ListWorkloadIdentityPools

UndeleteWorkloadIdentityPool

UndeleteWorkloadIdentityPoolProvider

UpdateWorkloadIdentityPool

UpdateWorkloadIdentityPoolProvider

google.iam.v2.Policies

The following audit logs are associated with methods belonging to google.iam.v2.Policies.

CreatePolicy

DeletePolicy

GetPolicy

  • Method: google.iam.v2.Policies.GetPolicy
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2.Policies.GetPolicy"

ListPolicies

  • Method: google.iam.v2.Policies.ListPolicies
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2.Policies.ListPolicies"

UpdatePolicy

google.iam.v2alpha.Policies

The following audit logs are associated with methods belonging to google.iam.v2alpha.Policies.

CreatePolicy

  • Method: google.iam.v2alpha.Policies.CreatePolicy
  • Audit log type: Admin activity
  • Permissions:
    • iam.googleapis.com/denypolicies.create - ADMIN_WRITE
  • Method is a long-running or streaming operation: Long-running operation
  • Filter for this method: protoPayload.methodName="google.iam.v2alpha.Policies.CreatePolicy"

DeletePolicy

  • Method: google.iam.v2alpha.Policies.DeletePolicy
  • Audit log type: Admin activity
  • Permissions:
    • iam.googleapis.com/denypolicies.delete - ADMIN_WRITE
  • Method is a long-running or streaming operation: Long-running operation
  • Filter for this method: protoPayload.methodName="google.iam.v2alpha.Policies.DeletePolicy"

GetPolicy

  • Method: google.iam.v2alpha.Policies.GetPolicy
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2alpha.Policies.GetPolicy"

ListPolicies

  • Method: google.iam.v2alpha.Policies.ListPolicies
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2alpha.Policies.ListPolicies"

UpdatePolicy

  • Method: google.iam.v2alpha.Policies.UpdatePolicy
  • Audit log type: Admin activity
  • Permissions:
    • iam.googleapis.com/denypolicies.update - ADMIN_WRITE
  • Method is a long-running or streaming operation: Long-running operation
  • Filter for this method: protoPayload.methodName="google.iam.v2alpha.Policies.UpdatePolicy"

google.iam.v2beta.Policies

The following audit logs are associated with methods belonging to google.iam.v2beta.Policies.

CreatePolicy

DeletePolicy

GetPolicy

  • Method: google.iam.v2beta.Policies.GetPolicy
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.get - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2beta.Policies.GetPolicy"

ListPolicies

  • Method: google.iam.v2beta.Policies.ListPolicies
  • Audit log type: Data access
  • Permissions:
    • iam.googleapis.com/denypolicies.list - ADMIN_READ
  • Method is a long-running or streaming operation: No.
  • Filter for this method: protoPayload.methodName="google.iam.v2beta.Policies.ListPolicies"

UpdatePolicy

Sample queries

To use the sample queries in the following table, complete these steps:

  1. Replace the variables in the query expression with your own project information, then copy the expression using the clipboard icon .

  2. In the Google Cloud console, go to the Logs Explorer page:

    Go to Logs Explorer

    If you use the search bar to find this page, then select the result whose subheading is Logging.

  3. Enable Show query to open the query-editor field, then paste the expression into the query-editor field:

    The query editor where you enter sample queries.

  4. Click Run query. Logs that match your query are listed in the Query results pane.

To find audit logs for Identity and Access Management, use the following queries in the Logs Explorer:

Before using the sample queries, replace the following values:

  • SERVICE_ACCOUNT_SHORT_ID: Everything preceding the @ symbol in the service account's email address. For example, the service account ID of the service account service-account@example.iam.gserviceaccount.com is service-account.
  • SERVICE_ACCOUNT_EMAIL: The full email address of the service account. For example, service-account@example.iam.gserviceaccount.com.
  • ROLE_NAME: The full role name, including any organizations/, projects/, or roles/ prefixes. For example, organizations/123456789012/roles/myCompanyAdmin.
Query name Expression
Service account created
resource.type = "service_account"
protoPayload.serviceName = "iam.googleapis.com"
protoPayload.methodName:"CreateServiceAccount"
log_id("cloudaudit.googleapis.com/activity")
(protoPayload.request.account_id:"SERVICE_ACCOUNT_SHORT_ID"
  OR protoPayload.response.email:"SERVICE_ACCOUNT_EMAIL")
Service account deleted
resource.type = "service_account"
protoPayload.serviceName = "iam.googleapis.com"
protoPayload.methodName:"DeleteServiceAccount"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.email_id:"SERVICE_ACCOUNT_EMAIL"
Service account key created
resource.type = "service_account"
protoPayload.serviceName = "iam.googleapis.com"
protoPayload.methodName:"CreateServiceAccountKey"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.email_id:"SERVICE_ACCOUNT_EMAIL"
Service account key deleted
resource.type = "service_account"
protoPayload.serviceName = "iam.googleapis.com"
protoPayload.methodName:"DeleteServiceAccountKey"
log_id("cloudaudit.googleapis.com/activity")
resource.labels.email_id:"SERVICE_ACCOUNT_EMAIL"
Any resource created, modified, or deleted
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:("create" OR "delete" OR "update")
Custom role updated
log_id("cloudaudit.googleapis.com/activity")
resource.type = "iam_role"
protoPayload.serviceName = "iam.googleapis.com"
protoPayload.methodName:"UpdateRole"
resource.labels.role_name:"ROLE_NAME"
Project-level allow policy updated
resource.type = "project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName:"SetIamPolicy"