Cloud Audit Logs provides the following audit logs for each Cloud project, folder, and organization:
- Admin Activity audit logs
- Data Access audit logs
- System Event audit logs
- Policy Denied audit logs
Google Cloud services write audit log entries to these logs to help you answer the questions of "who did what, where, and when?" within your Google Cloud resources.
Publicly available resources that have the Identity and Access Management policies
allAuthenticatedUsers
or
allUsers
don't generate audit logs.
This helps protect end-user identities and information.
For a list of Google Cloud services that provide audit logs, go to Google services with audit logs. All Google Cloud services will eventually provide audit logs.
Admin Activity audit logs
Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions.
To view these logs, you must have the IAM role Logging/Logs Viewer or Project/Viewer.
Admin Activity audit logs are always written; you can't configure or disable them. There is no charge for your Admin Activity audit logs. For details on logging usage limits, go to Quotas and limits.
Data Access audit logs
Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. Data Access audit logs do not record the data-access operations on resources that are publicly shared (available to All Users or All Authenticated Users) or that can be accessed without logging into Google Cloud.
To view these logs, you must have the IAM roles Logging/Private Logs Viewer or Project/Owner.
Data Access audit logs-- except for BigQuery Data Access audit logs-- are disabled by default because audit logs can be quite large. If you want Data Access audit logs to be written for Google Cloud services other than BigQuery, you must explicitly enable them. Enabling the logs might result in your Cloud project being charged for the additional logs usage. For instructions on enabling and configuring Data Access audit logs, go to Configuring Data Access logs.
For details on logging usage limits, go to Quotas and limits. For details on costs you might incur, go to Pricing.
System Event audit logs
System Event audit logs contain log entries for Google Cloud administrative actions that modify the configuration of resources. System Event audit logs are generated by Google systems; they are not driven by direct user action.
To view these logs, you must have the IAM role Logging/Logs Viewer or Project/Viewer.
System Event audit logs are always written; you can't configure or disable them. There is no charge for your System Event audit logs. For details on logging usage limits, go to Quotas and limits.
Policy Denied audit logs
Cloud Logging records Policy Denied audit logs when a Google Cloud service denies access to a user or service account because of a security policy violation.
To view these logs, you must have the IAM role Logging/Logs Viewer or Project/Viewer.
Policy Denied audit logs are generated by default and your Cloud project is charged for the logs storage. You can use Logs exclusions to exclude Policy Denied logs from ingestion into Cloud Logging. For details on logging usage limits, go to Quotas and limits. For details on costs you might incur, go to Pricing.
Audit log entry structure
Every audit log entry in Cloud Logging is an object of type
LogEntry
. What distinguishes an audit log entry from other log
entries is the protoPayload
field; this field contains an
AuditLog
object that stores the audit logging data.
To understand how to read and interpret audit log entries, review Understanding audit logs.
Viewing audit logs
To find and view audit logs, you need to know the identifier of the
Cloud project, folder, or organization for which you want to view
audit logging information. You can further specify other indexed
LogEntry
fields, like resource.type
; for details, review
Finding log entries quickly.
The following are the audit log names; they include variables for the identifiers of the Cloud project, folder, or organization:
projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicy folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivity folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_access folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fsystem_event folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fpolicy organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fsystem_event organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fpolicy
You have several options for viewing your audit log entries.
Console
You can use the Logs Explorer in the Cloud Console to retrieve your audit log entries for your Cloud project:
In the Cloud Console, go to the Logging > Logs Explorer page.
On the Logs Explorer page, select an existing Cloud project.
In the Query builder pane, do the following:
In Resource, select the Google Cloud resource type whose audit logs you want to see.
In Log name, select the audit log type that you want to see:
- For Admin Activity audit logs, select activity.
- For Data Access audit logs, select data_access.
- For System Event audit logs, select system_event.
- For Policy Denied audit logs, select policy.
If you don't see these options, then there aren't any audit logs of that type available in the Cloud project.
For more details about querying using the new Logs Explorer, see Building log queries.
gcloud
The gcloud
command-line tool provides a command-line interface to the
Cloud Logging API. Supply a valid
PROJECT_ID
, FOLDER_ID
,
or ORGANIZATION_ID
in each of the log names.
To read your Google Cloud project-level audit log entries, run the following command:
gcloud logging read "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" --project=PROJECT_ID
To read your folder-level audit log entries, run the following command:
gcloud logging read "logName : folders/FOLDER_ID/logs/cloudaudit.googleapis.com" --folder=FOLDER_ID
To read your organization-level audit log entries, run the following command:
gcloud logging read "logName : organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com" --organization=ORGANIZATION_ID
For more information about using the gcloud
tool, see
Reading log entries.
API
When building your queries, replace the variables with valid values, substitute the appropriate project-level, folder-level, or organization-level audit log name or identifiers as listed in the audit log names. For example, if your query includes a PROJECT_ID, then the project identifier you supply must refer to the currently selected Cloud project.
To use the Logging API to look at your audit log entries, do the following:
Go to the Try this API section in the documentation for the
entries.list
method.Put the following into the Request body part of the Try this API form. Clicking on this prepopulated form automatically fills the request body, but you need to supply a valid
PROJECT_ID
in each of the log names.{ "resourceNames": [ "projects/PROJECT_ID" ], "pageSize": 5, "filter": "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" }
Click Execute.
For more details about querying, see Logging query language.
For a sample audit log entry and how to find the most important information in it, see Understanding audit logs.
Using the Activity page
You can view abbreviated audit log entries in your Cloud project or organization's Activity page in the Cloud Console. To view abbreviated audit log entries, do the following:
Go to the Activity page:
In the project selector, select the Cloud project or organization for which you want to view audit logs entries.
In the Filter panel, select the entries you want to view.
The actual audit log entries might contain more information than appears on the Activity page.
In the Activity page, where the identity performing logged actions is
redacted from the audit log entry, User (anonymized)
is displayed. For more
details, read User identities in audit logs on this page.
Exporting audit logs
You can export audit log entries to Cloud Logging or to certain Google Cloud services.
To export audit log entries outside of Logging, create a logs sink. Give the sink a query that specifies the audit log types you want to export; for query examples, go to Security logging queries.
If you want to export audit log entries for a Google Cloud organization, folder, or billing account, review Aggregated sinks.
The maximum size an audit log can be is shown in the table below. These values can help you estimate the space needed for an export destination.
Audit log | Maximum size |
---|---|
Admin activity | 512 KiB |
Data access | 512 KiB |
System event | 512 KiB |
Policy Denied | 512 KiB |
Audit log retention
Individual audit log entries are kept for a specified length of time and are then deleted. For details on how long log entries are retained by Logging, review the retention information in Quotas and limits: Logs retention periods. You cannot otherwise delete or modify audit logs entries.
Audit log type | Retention period |
---|---|
Admin Activity | 400 days |
Data Access | 30 days |
System Event | 400 days |
Policy Denied | 30 days |
For longer retention, you can export audit log entries like any other Logging log entries and keep them for as long as you wish.
You can also configure Cloud Logging to retain your logs between 1 day and 3650 days. For details, see Storing logs: Custom retention.
Caller identities in audit logs
Audit logs record the identity that performed the logged operations on the
Google Cloud resource. The caller's identity is held in the
AuthenticationInfo
field of AuditLog objects.
In the following circumstances, the caller's principal email address is redacted from audit logs if all of these conditions are met:
- This is a read-only operation.
- The operation fails with a "permission denied" error.
- If the identity is a service account, and the identity isn't a member of the Google Cloud organization associated with the resource. If the identity isn't a service account, then this condition doesn't apply.
In addition to the conditions listed above, the following applies to certain Google Cloud products:
Legacy App Engine API: Identities are not collected at all.
BigQuery: Caller identities and IP addresses, as well as some resource names, are redacted from the audit logs, unless certain conditions are met. For details, go to BigQuery audit logs overview.
If you are viewing audit logs using the Google Cloud Console
Activity page, User (anonymized)
is displayed for any log
entries where identity is redacted or empty.
Google services producing audit logs
For a list of Google Cloud services that provide audit logs, go to Google services with audit logs. All Google Cloud services will eventually provide audit logs.