GCP Audit Logs

What Are Audit Logs?

Think of audit logs as the official security logbook for your Google Cloud environment. Every time someone interacts with your resources—whether it's creating a virtual machine, accessing a database, or changing a permission—an entry is made. These logs answer critical questions: Who did what, where, and when? They provide a trail of activity that is essential for security analysis, troubleshooting, and compliance.

Cloud Audit Logs capture all administrative activity within GCP.

Google Cloud automatically generates these logs for most services, giving you a transparent view of all the actions taking place. Understanding them is the first step toward securing your cloud resources effectively.

Types of Audit Logs

Google Cloud organizes audit logs into four distinct categories. Each type serves a different purpose, and not all are enabled by default because some can generate a massive amount of data.

Log Type	What It Tracks	Enabled by Default?
Admin Activity	Administrative actions that modify the configuration or metadata of resources.	Yes
Data Access	API calls that read resource configurations or user-provided data.	No (except for BigQuery)
System Event	Actions performed by Google Cloud systems, not by users.	Yes
Policy Denied	Attempts to access a resource that were denied due to a security policy.	Yes

Admin Activity logs are always on and can't be disabled. They track significant changes, like creating a new virtual machine or modifying an IAM policy.

Data Access logs are high-volume and track read-only operations. For example, every time a user queries a BigQuery table, a Data Access log is generated. Because they can be so numerous, you must explicitly enable them for most services.

System Event logs record actions taken by Google's systems on your behalf, like an automatic instance migration.

Policy Denied logs are crucial for security. They record when a user or service account tried to do something but was stopped by a permission error. This can help you spot misconfigurations or potential security threats.

Accessing and Reading Logs

You can view all your audit logs directly in the Google Cloud Console using the Logs Explorer. This interface allows you to search, filter, and analyze log data from all your GCP services in one place.

Each log entry is a structured JSON object containing detailed information about the event. While they can look complex, they follow a consistent format. Here are the key fields to pay attention to.

{
  "protoPayload": { 
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "user@example.com"
    },
    "methodName": "v1.compute.instances.delete",
    "resourceName": "projects/my-gcp-project/zones/us-central1-a/instances/my-vm-instance"
  },
  "resource": {
    "type": "gce_instance",
    "labels": { ... }
  },
  "timestamp": "2024-05-21T10:00:00Z",
  "logName": "projects/my-gcp-project/logs/cloudaudit.googleapis.com%2Factivity"
}

Let's break that down:

authenticationInfo.principalEmail: The user or service account that performed the action.
methodName: The specific API method that was called (e.g., instances.delete).
resourceName: The resource that was affected by the action.
timestamp: When the event occurred.

By examining these fields, you can piece together the full story of what happened. In the example above, user@example.com deleted the virtual machine my-vm-instance.

Why Logs Matter for Security

Audit logs are the foundation of cloud security monitoring. They are your eyes and ears across all services, from Kubernetes and BigQuery to Cloud SQL databases and IAM.

By regularly reviewing these logs, you can track user activity to ensure actions are authorized. For example, you can see if a user is trying to access sensitive data in a BigQuery table they shouldn't have access to. You can also trace the source of operational issues by seeing what changes were made right before a problem started.

Monitoring Policy Denied logs is especially important. A spike in these logs could indicate a misconfigured application or an attacker attempting to probe your environment for weaknesses.

Now, let's test your understanding of these different log types.

Quiz Questions 1/5

Which category of Google Cloud Audit Logs is always enabled by default and cannot be disabled?

Quiz Questions 2/5

An automated script with the wrong permissions attempts to delete a virtual machine and fails. Which type of audit log would capture this failed attempt?

By understanding and utilizing GCP's audit logs, you gain crucial visibility into your environment, enabling you to maintain a strong security posture.

GCP Audit Logs for Security Detection