Introduction to GCP Audit Logs

Who Did What, and When?

Imagine running a busy office building. You'd want to know who enters, what doors they open, and when they do it. In the digital world of Google Cloud Platform (GCP), that's exactly what Audit Logs do. They act as a security camera and a logbook for your cloud environment, automatically recording a trail of activities performed by users, applications, and by Google itself.

This detailed record is crucial for security analysis, auditing compliance, and troubleshooting problems. It answers the fundamental questions of who, what, where, and when for all actions taken on your GCP resources.

Audit logs in GCP track API activity and access to your resources.

The Four Types of Logs

GCP organizes audit logs into four distinct categories, each serving a different purpose.

Admin Activity

noun

Logs administrative actions that modify the configuration or metadata of resources. This includes creating a virtual machine, changing a firewall rule, or modifying user permissions. These logs are always enabled and cannot be turned off.

Next are Data Access logs. These record API calls that read resource configurations or metadata, as well as user-driven API calls that create, modify, or read user-provided resource data. Think of someone reading a file from a storage bucket or querying a database. Because these can generate a huge volume of entries, they are disabled by default, except for BigQuery.

Enabling Data Access logs is essential for tracking who is accessing sensitive information, but be mindful of the potential cost and log volume.

System Event logs record actions taken by Google Cloud systems, not by a user. For example, if a hardware failure triggers a live migration of a virtual machine, a system event log is generated. Like Admin Activity logs, these are always on.

Finally, Policy Denied logs are recorded whenever a user or service account is denied access to a resource due to a security policy violation. If someone tries to perform an action they don't have permission for, this log records the attempt. This is incredibly useful for debugging permission issues and identifying potential security probes.

Log Type	What It Tracks	Enabled by Default?
Admin Activity	Configuration or metadata changes	Yes
Data Access	Reading data or configurations	No*
System Event	Actions performed by Google systems	Yes
Policy Denied	When access is denied due to a security policy	Yes

*Data Access logs are enabled for BigQuery by default, but must be manually enabled for other services.

Anatomy of a Log Entry

Every audit log entry is a structured piece of data containing key information. While there are many fields, a few are fundamental to understanding any log.

{
  "logName": "projects/my-gcp-project/logs/cloudaudit.googleapis.com%2Factivity",
  "resource": {
    "type": "gce_instance",
    "labels": {
      "instance_id": "1234567890123456789",
      "project_id": "my-gcp-project",
      "zone": "us-central1-a"
    }
  },
  "timestamp": "2023-10-27T10:00:00.123456Z",
  "severity": "NOTICE",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "user@example.com"
    },
    "methodName": "v1.compute.instances.delete",
    "serviceName": "compute.googleapis.com",
    "resourceName": "projects/my-gcp-project/zones/us-central1-a/instances/test-instance"
  }
}

Let's break down the key parts:

logName: Identifies the log, including the project ID and the type of log (in this case, activity for Admin Activity).
resource: Describes the specific resource the action was performed on, like a gce_instance (a virtual machine).
timestamp: The exact time the event occurred, in Coordinated Universal Time (UTC).
severity: The severity level of the log entry, such as NOTICE, INFO, or ERROR.
protoPayload: This is the heart of the log. It's a nested object containing the specifics of the event, including principalEmail (who did it), methodName (what they did), and serviceName (which service they used).

Understanding this structure is the first step to effectively querying and analyzing your logs to monitor your cloud environment.

GCP Audit Logs Explained