Cloud Audit Logs
1. Cloud Audit Logs
Cloud Audit Logs maintains audit logs for each project, folder, and organization. Having an audit trail of all operations performed within your environment is very important. In this section, we will explore how to use Cloud Audit Logs. Cloud Audit Logs records Google Cloud account activity, including actions performed with the Google Cloud console, command line tools, APIs, and AWS services. Cloud Audit Logs helps you answer the questions of: Who did what, where, and when within your Google Cloud projects. Cloud Audit Logs maintains four audit logs for each project, folder, and organization, which are Admin Activity logs, System Events, Data Access logs, and Policy Denied logs. Admin Activity audit logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. For example, the logs record when VM instances and App Engine applications are created and when permissions are changed. Admin Activity audit logs are always enabled by default and there is no charge for your Admin Activity audit logs. System Event audit logs contain log entries for when Compute Engine performs a system event. For example, each live migration is recorded as a system event. System Event audit logs are always enabled and there is no charge for your System Event audit logs. Data Access audit logs record API calls that create, modify, or read user-provided data. These logs are disabled by default because they can be quite large. Enabling the logs might result in your project being charged for the additional logs usage. Note that Data Access audit logs do not record data-access operations on resources that are publicly shared. Policy Denied audit logs are recorded when a Google Cloud service denies access to a user or service account because of a security policy violation. Policy Denied audit logs are generated by default and your Cloud project is charged for the logs storage. You can't disable Policy Denied audit logs, but you can use exclusion filters to prevent Policy Denied audit logs from being ingested and stored in Cloud Logging. BigQuery Data Access audit logs are handled differently from other Data Access logs. BigQuery logs are enabled by default and cannot be disabled. You can view audit log entries in your project's Activity page, in the Logs Explorer, in the Cloud Logging API, and in the Google Cloud SDK. You can also export audit log entries to Cloud Logging, Pub/Sub, or Cloud Storage. To view the logs, you must have the IAM roles Logs Viewer for Admin Activity logs and Private Logs Viewer for Data Access logs. For more information on Cloud Logging roles, see Access Control. Individual audit log entries are kept for a specified length of time and are then deleted. Admin activity and system events are kept for 400 days, while data access logs are kept for 30 days. For longer retention, you can export audit log entries from Cloud Logging and keep them for as long as you wish. Just like other logs, you can also export audit log entries to Cloud Storage, Pub/Sub, or BigQuery. When exporting logs, log filters can be defined to limit which log events are exported. This can help reduce the amount of data exported and reduce the scope of the data. When you export to BigQuery datasets, Cloud Logging creates dated tables to hold the exported log entries. The data can then be analyzed using BigQuery. Log files can also be exported to Pub/Sub and to storage buckets, which facilitates analyzing the data with third-party tools.2. Let's practice!
Create Your Free Account
or
By continuing, you accept our Terms of Use, our Privacy Policy and that your data is stored in the USA.