[[["わかりやすい","easyToUnderstand","thumb-up"],["問題の解決に役立った","solvedMyProblem","thumb-up"],["その他","otherUp","thumb-up"]],[["わかりにくい","hardToUnderstand","thumb-down"],["情報またはサンプルコードが不正確","incorrectInformationOrSampleCode","thumb-down"],["必要な情報 / サンプルがない","missingTheInformationSamplesINeed","thumb-down"],["翻訳に関する問題","translationIssue","thumb-down"],["その他","otherDown","thumb-down"]],["最終更新日 2025-04-21 UTC。"],[[["\u003cp\u003eAccess Transparency logs allow you to audit Google personnel access to your content, integrating with SIEM tools for automated monitoring.\u003c/p\u003e\n"],["\u003cp\u003eThese logs detail the affected resource, action time, reasons for access (like customer support cases), and information about the accessing Google personnel.\u003c/p\u003e\n"],["\u003cp\u003eYou can view Access Transparency logs in the Google Cloud console by assigning the \u003cstrong\u003ePrivate Logs Viewer\u003c/strong\u003e role and using a specific logging filter.\u003c/p\u003e\n"],["\u003cp\u003eThe logs can be monitored using the Cloud Monitoring API or Cloud Run functions, and you can create logs-based metrics with alerting policies to monitor for an excess of access.\u003c/p\u003e\n"],["\u003cp\u003eAccess Transparency logs include a detailed breakdown of each access event, including the type of access, the method used (e.g., \u003ccode\u003eGoogleInternal.Read\u003c/code\u003e), the resource accessed, and the justification for access.\u003c/p\u003e\n"]]],[],null,["# Understanding and using Access Transparency logs\n================================================\n\nThis page describes the contents of Access Transparency log entries and how\nto view and use them.\n\nAccess Transparency logs in detail\n----------------------------------\n\nAccess Transparency logs can be integrated with your existing\nsecurity information and event management (SIEM) tools to automate your audits\nof Google personnel when they access your content. Access Transparency logs are\navailable in the Google Cloud console alongside your Cloud Audit Logs.\n\nAccess Transparency log entries include the following types of details:\n\n- The affected resource and action.\n- The time of the action.\n- The [reasons](#justification-reason-codes) for the action (for example, the case number associated with a customer support request).\n- Data about who is acting on the content (for example, the Google personnel's location).\n\nEnabling Access Transparency\n----------------------------\n\nFor information about enabling Access Transparency for your Google Cloud organization,\nsee [Enabling Access Transparency](/assured-workloads/access-transparency/docs/enable).\n\nViewing Access Transparency logs\n--------------------------------\n\nAfter you've configured Access Transparency for your Google Cloud\norganization, you can set controls for who can access the Access Transparency logs by\nassigning a user or group the **Private Logs Viewer** role. See the\n[Cloud Logging access control guide](/logging/docs/access-control) for\ndetails.\n\nTo view Access Transparency logs, use the following Google Cloud Observability logging filter. \n\n logName=\"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Faccess_transparency\"\n\nTo learn how to see your Access Transparency logs in the Logs Explorer, see\n[Using the Logs Explorer](/logging/docs/view/logs-explorer-interface).\n\nYou can also monitor the logs by using the Cloud Monitoring API or using\nCloud Run functions. To get started, see the\n[Cloud Monitoring documentation](/monitoring/docs).\n\nOptional: Create a\n[logs-based metric](/logging/docs/logs-based-metrics/counter-metrics) and then\nset up an\n[alerting policy](/logging/docs/logs-based-metrics/charts-and-alerts#alert-on-lbm)\nto give you timely awareness of issues surfaced by these logs.\n\nSample Access Transparency log entry\n------------------------------------\n\nThe following is an example of an Access Transparency log entry: \n\n```gdscript\n{\n insertId: \"abcdefg12345\"\n jsonPayload: {\n @type: \"type.googleapis.com/google.cloud.audit.TransparencyLog\"\n location: {\n principalOfficeCountry: \"US\"\n principalEmployingEntity: \"Google LLC\"\n principalPhysicalLocationCountry: \"CA\"\n }\n principalJobTitle: \"Engineering\"\n product: [\n 0: \"Cloud Storage\"\n ]\n reason: [\n detail: \"Case number: bar123\"\n type: \"CUSTOMER_INITIATED_SUPPORT\"\n ]\n eventId: \"asdfg12345asdfg12345asdfg12345\"\n accesses: [\n 0: {\n methodName: \"GoogleInternal.Read\"\n resourceName: \"//googleapis.com/storage/buckets/\u003cvar translate=\"no\"\u003eBUCKET_NAME\u003c/var\u003e/objects/foo123\"\n }\n ]\n accessApprovals: [\n 0: \"projects/123/approvalRequests/abcdef12345\"\n ]\n }\n logName: \"projects/\u003cvar translate=\"no\"\u003ePROJECT_ID\u003c/var\u003e/logs/cloudaudit.googleapis.com%2Faccess_transparency\"\n operation: {\n id: \"12345xyz\"\n }\n receiveTimestamp: \"2017-12-18T16:06:37.400577736Z\"\n resource: {\n labels: {\n project_id: \"1234567890\"\n }\n type: \"project\"\n }\n severity: \"NOTICE\"\n timestamp: \"2017-12-18T16:06:24.660001Z\"\n}\n```\n\nLog field descriptions\n----------------------\n\n### Values for `accesses:methodNames` field\n\nThe following methods can appear in the `accesses:methodNames` field in Access Transparency logs:\n\n- **Standard methods** : These methods are `List`, `Get`, `Create`, `Update`, and `Delete`. For more information, see [Standard methods](/apis/design/standard_methods).\n- **Custom methods** : Custom methods refer to API methods besides the 5 standard methods. Common custom methods include `Cancel`, `BatchGet`, `Move`, `Search`, and `Undelete`. For more information, see [Custom methods](/apis/design/custom_methods).\n- **GoogleInternal methods** : The following are examples of `GoogleInternal` methods that appear in the `accesses:methodNames` field:\n\nThe `GoogleInternal` accesses are strictly restricted to authorized personnel for justified and auditable access. The presence of a method doesn't indicate availability to all roles. Organizations seeking enhanced controls over administrative access on a project or organization can activate Access Approval to enable approval or denial of accesses based on access details. For example, Access Approval users can choose to permit only requests with the `CUSTOMER_INITIATED_SUPPORT` justification for requests made by a Google employee. For more information, see [Overview of Access Approval](/assured-workloads/access-approval/docs/overview).\n\nIf an event meets strict emergency access criteria, Access Approval can log that emergency access with the `auto approved` status. Access Transparency and Access Approval are specifically designed to include uninterrupted logging for emergency access scenarios.\n\nIf you are looking for more data security control over your workloads, we recommend using [Assured Workloads](/assured-workloads/docs/overview). Assured Workloads projects offer enhanced functionalities such as, data residency, sovereign controls, and access to features such as confidential computing in Compute Engine. It leverages [Key Access Justifications](/assured-workloads/key-access-justifications/docs/overview) for externally-managed encryption keys.\n\nJustification reason codes\n--------------------------\n\n\nMonitoring Access Transparency logs\n-----------------------------------\n\nYou can monitor Access Transparency logs by using the Cloud Monitoring API.\nTo get started, see the [Cloud Monitoring documentation](/monitoring/docs).\n\nYou can set up a\n[logs-based metric](/logging/docs/logs-based-metrics/counter-metrics) and then\nset up an\n[alerting policy](/logging/docs/logs-based-metrics/charts-and-alerts#alert-on-lbm)\nto give you timely awareness of issues surfaced by these logs.\nFor example, you can create a logs-based metric that captures\nGoogle personnel accesses of your content and then create an alerting policy in\nMonitoring that lets you know if the number of accesses in a\ngiven period exceeds a specified threshold.\n\nWhat's next\n-----------\n\n- Learn how to [view and understand Access Transparency logs for\n Google Workspace services](/assured-workloads/access-transparency/docs/understanding-workspace-logs)."]]
