Audits (including logs)
In this tutorial we will learn and understand about Audits (including logs).
However, cloud Audit Logs provides the following audit logs for each Cloud project, folder, and organization:
- Firstly, Admin Activity audit logs
- Secondly, Data Access audit logs
- Thirdly, System Event audit logs
- Lastly, Policy Denied audit logs
Admin Activity audit logs
Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, these logs record when users create VM instances or change Identity and Access Management permissions. Further, Admin Activity audit logs are always written. So, you can’t configure or disable them. There is no charge for your Admin Activity audit logs
Data Access audit logs
Data Access audit logs contain API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data. However, Data Access audit logs do not record the data-access operations on resources that are publicly shared. Or those with access without logging into Google Cloud. Further, Data Access audit logs are disabled by default because they can be quite large. So, they must be explicitly enabled to be written. Enabling the logs might result in your Cloud project being charge for the additional logs usage.
System Event audit logs
System Event audit logs contain log entries for Google Cloud administrative actions that modify the configuration of resources and are generated by Google systems; they are not driven by direct user action. However, these audits are always written; you can’t configure or disable them. There is no charge for your System Event audit logs.
Policy Denied audit logs
Cloud Logging records Policy Denied audit logs when a Google Cloud service denies access to a user or service account because of a security policy violation. However, Policy Denied audit logs are generated by default and your Cloud project is charged for the logs storage. You can use Logs exclusions to exclude Policy Denied logs from ingestion into Cloud Logging.
Viewing audit logs
To find and view audit logs, you need to know the identifier of the Cloud project, folder, or organization for which you want to view audit logging information. However, you have several options for viewing your audit log entries. You can use the Logs Explorer in the Cloud Console to retrieve your audit log entries for your Cloud project:
- Firstly, in the Cloud Console, go to the Logging > Logs Explorer page.
Secondly, on the Logs Explorer page, select an existing Cloud project. - Thirdly, in the Query builder pane, do the following:
- In Resource, select the Google Cloud resource type whose audit logs you want to see.
- In Log name, select the audit log type that you want to see:
- For Admin Activity audit logs, select activity.
- Then, for Data Access audit logs, select data_access.
- For System Event audit logs, select system_event.
- Lastly, for Policy Denied audit logs, select policy.
Using the Activity page
You can view abbreviated audit log entries in your Cloud project or organization’s Activity page in the Cloud Console. To view abbreviated audit log entries, do the following:
- Firstly, go to the Activity page.
- Secondly, in the project selector, select the Cloud project or organization for which you want to view audit logs entries.
- Lastly, in the Filter panel, select the entries you want to view.
Caller identities in audit logs
Audit logs record the identity that performed the logged operations on the Google Cloud resource. The caller’s identity is held in the AuthenticationInfo field of AuditLog objects. However, in the following circumstances, the caller’s principal email address is redacted from audit logs if all of these conditions are met:
- Firstly, this is a read-only operation.
- Secondly, the operation fails with a “permission denied” error.
- Lastly, if the identity is a service account, and the identity isn’t a member of the Google Cloud organization in association with the resource. If the identity isn’t a service account, then this condition doesn’t apply.
Reference: Google Documentation