{
	"id": "2e5e52d1-5635-4833-96d7-9b5796c7c089",
	"created_at": "2026-04-06T02:10:39.250202Z",
	"updated_at": "2026-04-10T03:20:36.615215Z",
	"deleted_at": null,
	"sha1_hash": "7c2f0260c635ea9773d846a067031ae635ad899c",
	"title": "Cloud Audit Logs overview",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 124576,
	"plain_text": "Cloud Audit Logs overview\r\nArchived: 2026-04-06 02:08:18 UTC\r\nThis document provides a conceptual overview of Cloud Audit Logs.\r\nGoogle Cloud services write audit logs that record administrative activities and accesses within your Google\r\nCloud resources. Audit logs help you answer \"who did what, where, and when?\" within your Google Cloud\r\nresources with the same level of transparency as in on-premises environments. Enabling audit logs helps your\r\nsecurity, auditing, and compliance entities monitor Google Cloud data and systems for possible vulnerabilities or\r\nexternal data misuse.\r\nGoogle Cloud services producing audit logs\r\nFor a list of Google Cloud services that provide audit logs, see Google Cloud services with audit logs. All Google\r\nCloud services will eventually provide audit logs.\r\nGoogle Cloud MCP servers write Data Access audit logs. Data Access audit logs written by Google Cloud MCP\r\nservers API calls are service-specific and use the format SERVICE_NAME.googleapis.com/mcp . You can enable\r\nthese Data Access logs by turning on audit logging for mcp.googleapis.com in the IAM AuditConfig object.\r\nFor more information about audit logging for Google Cloud MCP servers, see Google Cloud MCP servers audit\r\nlogging.\r\nFor an overview of Google Workspace audit logs, see Audit logs for Google Workspace.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 1 of 9\n\nRequired roles\r\nTo view audit logs, you must have the appropriate Identity and Access Management (IAM) permissions and roles:\r\nTo get the permissions that you need to get read-only access to Admin Activity, Policy Denied, and System\r\nEvent audit logs, ask your administrator to grant you the Logs Viewer ( roles/logging.viewer ) IAM role\r\non your project.\r\nIf you have only the Logs Viewer role (roles/logging.viewer) , then you cannot view Data Access audit\r\nlogs that are in the _Default bucket.\r\nTo get the permissions that you need to get access to all logs in the _Required and _Default buckets,\r\nincluding Data Access logs, ask your administrator to grant you the Private Logs Viewer\r\n( roles/logging.privateLogViewer ) IAM role on your project.\r\nThe Private Logs Viewer role (roles/logging.privateLogViewer) includes the permissions contained in\r\nthe Logs Viewer role ( roles/logging.viewer ), and those necessary to read Data Access audit logs in the\r\n_Default bucket.\r\nFor more information about the IAM permissions and roles that apply to audit logs data, see Access control with\r\nIAM.\r\nTypes of audit logs\r\nCloud Audit Logs provides the following audit logs for each Google Cloud project, folder, and organization:\r\nAdmin Activity audit logs\r\nData Access audit logs\r\nSystem Event audit logs\r\nPolicy Denied audit logs\r\nAdmin Activity audit logs\r\nAdmin Activity audit logs are log entries written by user-driven API calls or other actions that modify the\r\nconfiguration or metadata of resources. For example, these logs record when users create VM instances or change\r\nIdentity and Access Management permissions.\r\nAdmin Activity audit logs are always written; you can't configure, exclude, or disable them. Even if you disable\r\nthe Cloud Logging API, Admin Activity audit logs are still generated.\r\nFor a list of services that write Admin Activity audit logs and detailed information about which activities generate\r\nthose logs, see Google Cloud services with audit logs.\r\nData Access audit logs\r\nData Access audit logs are log entries written by API calls that read the configuration or metadata of resources.\r\nThey are also written by user-driven API calls that create, modify, or read user-provided resource data.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 2 of 9\n\nPublicly available resources that have the Identity and Access Management policies allAuthenticatedUsers or\r\nallUsers don't generate audit logs. Resources that can be accessed without logging into a Google Cloud, Google\r\nWorkspace, Cloud Identity, or Drive Enterprise account don't generate audit logs. This helps protect end-user\r\nidentities and information.\r\nData Access audit logs—except for BigQuery Data Access audit logs—are disabled by default because audit logs\r\ncan be quite large. If you want Data Access audit logs to be written for Google Cloud services other than\r\nBigQuery, you must explicitly enable them. Data Access audit logs are written to the Google Cloud project whose\r\ndata is accessed. Enabling these logs might result in your Google Cloud project being charged for the additional\r\nlogs usage. For instructions on enabling and configuring Data Access audit logs, see Enable Data Access audit\r\nlogs.\r\nFor a list of services that write Data Access audit logs and detailed information about which activities generate\r\nthose logs, see Google Cloud services with audit logs.\r\nData Access audit logs are stored in the _Default log bucket unless you've routed them elsewhere. For more\r\ninformation, see the Storing and routing audit logs section of this page.\r\nSystem Event audit logs\r\nSystem Event audit logs are log entries written by Google Cloud systems that modify the configuration of\r\nresources. System Event audit logs aren't driven by direct user action. For example, a System Event audit log is\r\nwritten when VMs are automatically added to or removed from managed instance groups (MIGs) due to\r\nautoscaling.\r\nSystem Event audit logs are always written; you can't configure, exclude, or disable them.\r\nFor a list of services that write System Event audit logs and detailed information about which activities generate\r\nthose logs, see Google Cloud services with audit logs.\r\nPolicy Denied audit logs\r\nPolicy Denied audit logs are log entries written when a Google Cloud service denies access to a user or service\r\naccount because of a security policy violation.\r\nPolicy Denied audit logs are generated by default and your Google Cloud project is charged for the logs storage.\r\nYou can't disable Policy Denied audit logs, but you can use exclusion filters to prevent Policy Denied audit logs\r\nfrom being stored in Cloud Logging.\r\nFor a list of services that write Policy Denied audit logs and detailed information about which activities generate\r\nthose logs, see Google Cloud services with audit logs.\r\nAudit log entry structure\r\nEvery audit log entry in Cloud Logging is an object of type LogEntry . What distinguishes an audit log entry\r\nfrom other log entries is the protoPayload field; this field contains an AuditLog object that stores the audit\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 3 of 9\n\nlogging data.\r\nTo understand how to read and interpret audit log entries, and for a sample of an audit log entry, see\r\nUnderstanding audit logs.\r\nLog name\r\nCloud Audit Logs log names include the following:\r\nResource identifiers indicating the Google Cloud project or other Google Cloud entity that owns the audit\r\nlogs.\r\nThe string cloudaudit.googleapis.com .\r\nA string that indicates whether the log contains Admin Activity, Data Access, Policy Denied, or System\r\nEvent audit logging data.\r\nThe following are the audit log names, including variables for the resource identifiers:\r\n projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity\r\n projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access\r\n projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event\r\n projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicy\r\n folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivity\r\n folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_access\r\n folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fsystem_event\r\n folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fpolicy\r\n billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Factivity\r\n billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fdata_access\r\n billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fsystem_event\r\n billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fpolicy\r\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity\r\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access\r\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fsystem_event\r\n organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fpolicy\r\nCaller identities in audit logs\r\nAudit logs record the identity that performed the logged operations on the Google Cloud resource. The caller's\r\nidentity is held in the AuthenticationInfo field of AuditLog objects.\r\nAudit logging doesn't redact the caller's principal email address for any access that succeeds or for any write\r\noperation.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 4 of 9\n\nFor read-only operations that fail with a \"permission denied\" error, Audit Logging might redact the caller's\r\nprincipal email address unless the caller is a service account.\r\nIn addition to the conditions listed above, the following applies to certain Google Cloud services:\r\nLegacy App Engine API: Identities aren't collected.\r\nBigQuery: Caller identities and IP addresses, as well as some resource names, are redacted from the audit\r\nlogs, unless certain conditions are met.\r\nCloud Storage: When Cloud Storage usage logs are enabled, Cloud Storage writes usage data to the Cloud\r\nStorage bucket, which generates Data Access audit logs for the bucket. The generated Data Access audit\r\nlog has its caller identity redacted.\r\nFirestore: If a JSON Web Token (JWT) was used for third-party authentication, the thirdPartyPrincipal\r\nfield includes the token's header and payload. For example, audit logs for requests authenticated with\r\nFirebase Authentication include that request's auth token.\r\nVPC Service Controls: For Policy Denied audit logs, the following redaction occurs:\r\nParts of the caller email addresses might be redacted and replaced by three period characters ... .\r\nSome caller email addresses belonging to the domain google.com are redacted and replaced by\r\ngoogle-internal .\r\nOrganization Policy: Parts of the caller email addresses might be redacted and replaced by three period\r\ncharacters ... .\r\nIP address of the caller in audit logs\r\nThe IP address of the caller is held in the RequestMetadata.callerIp field of the AuditLog object:\r\nFor a caller from the internet, the address is a public IPv4 or IPv6 address.\r\nFor calls made from inside the internal production network from one Google Cloud service to another, the\r\ncallerIp is redacted to \"private\".\r\nFor a caller from a Compute Engine VM with a external IP address, the callerIp is the external address\r\nof the VM.\r\nFor a caller from a Compute Engine VM without a external IP address, if the VM is in the same\r\norganization or project as the accessed resource, then callerIp is the VM's internal IPv4 address.\r\nOtherwise, the callerIp is redacted to \"gce-internal-ip\". For more information, see VPC network\r\noverview.\r\nViewing audit logs\r\nYou can query for all audit logs or you can query for logs by their audit log name. The audit log name includes the\r\nresource identifier of the Google Cloud project, folder, billing account, or organization for which you want to view\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 5 of 9\n\naudit logging information. Your queries can specify indexed LogEntry fields. For more information about\r\nquerying your logs, see Build queries in the Logs Explorer\r\nThe Logs Explorer lets you view filter individual log entries. If you want to use SQL to analyze groups of log\r\nentries, then use the Log Analytics page. For more information, see:\r\nQuery and view logs in Observability Analytics.\r\nSample queries for security insights.\r\nChart query results.\r\nMost audit logs can be viewed in Cloud Logging by using the Google Cloud console, the Google Cloud CLI, or\r\nthe Logging API. However, for audit logs related to billing, you can only use the Google Cloud CLI or the\r\nLogging API.\r\nIn the Google Cloud console, you can use the Logs Explorer to retrieve your audit log entries for your Google\r\nCloud project, folder, or organization:\r\n1. In the Google Cloud console, go to the Logs Explorer page:\r\nGo to Logs Explorer\r\nIf you use the search bar to find this page, then select the result whose subheading is Logging.\r\n2. Select an existing Google Cloud project, folder, or organization.\r\n3. To display all audit logs, enter either of the following queries into the query-editor field, and then click\r\nRun query:\r\nlogName:\"cloudaudit.googleapis.com\"\r\nprotoPayload.\"@type\"=\"type.googleapis.com/google.cloud.audit.AuditLog\"\r\n4. To display the audit logs for a specific resource and audit log type, in the Query builder pane, do the\r\nfollowing:\r\nIn Resource type, select the Google Cloud resource whose audit logs you want to see.\r\nIn Log name, select the audit log type that you want to see:\r\nFor Admin Activity audit logs, select activity.\r\nFor Data Access audit logs, select data_access.\r\nFor System Event audit logs, select system_event.\r\nFor Policy Denied audit logs, select policy.\r\nClick Run query.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 6 of 9\n\nIf you don't see these options, then there aren't any audit logs of that type available in the Google Cloud\r\nproject, folder, or organization.\r\nIf you're experiencing issues when trying to view logs in the Logs Explorer, see the troubleshooting\r\ninformation.\r\nFor more information about querying by using the Logs Explorer, see Build queries in the Logs Explorer.\r\nThe Google Cloud CLI provides a command-line interface to the Logging API. Supply a valid resource identifier\r\nin each of the log names. For example, if your query includes a PROJECT_ID, then the project identifier you\r\nsupply must refer to the currently selected Google Cloud project.\r\nTo read your Google Cloud project-level audit log entries, run the following command:\r\ngcloud logging read \"logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com\" \\\r\n --project=PROJECT_ID\r\nTo read your folder-level audit log entries, run the following command:\r\ngcloud logging read \"logName : folders/FOLDER_ID/logs/cloudaudit.googleapis.com\" \\\r\n --folder=FOLDER_ID\r\nTo read your organization-level audit log entries, run the following command:\r\ngcloud logging read \"logName : organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com\" \\\r\n --organization=ORGANIZATION_ID\r\nTo read your Cloud Billing account-level audit log entries, run the following command:\r\ngcloud logging read \"logName : billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com\" \\\r\n --billing-account=BILLING_ACCOUNT_ID\r\nAdd the --freshness flag to your command to read logs that are more than 1 day old.\r\nFor more information about using the gcloud CLI, see gcloud logging read .\r\nWhen building your queries, supply a valid resource identifier in each of the log names. For example, if your\r\nquery includes a PROJECT_ID, then the project identifier you supply must refer to the currently selected Google\r\nCloud project.\r\nFor example, to use the Logging API to view your project-level audit log entries, do the following:\r\n1. Go to the Try this API section in the documentation for the entries.list method.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 7 of 9\n\n2. Put the following into the Request body part of the Try this API form. Clicking this prepopulated form\r\nautomatically fills the request body, but you need to supply a valid PROJECT_ID in each of the log names.\r\n{\r\n \"resourceNames\": [\r\n \"projects/PROJECT_ID\"\r\n ],\r\n \"pageSize\": 5,\r\n \"filter\": \"logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com\"\r\n}\r\n3. Click Execute.\r\nStoring and routing audit logs\r\nCloud Logging uses log buckets as containers that store and organize your logs data. For each billing account,\r\nGoogle Cloud project, folder, and organization, Logging automatically creates two log buckets, _Required and\r\n_Default , and correspondingly named sinks.\r\nCloud Logging _Required buckets store Admin Activity audit logs and System Event audit logs. You can't\r\nprevent Admin Activity or System Event audit logs from being stored. You also can't configure the sink that routes\r\nlog entries to the _Required buckets.\r\nAdmin Activity audit logs and System Event audit logs are always stored in the _Required bucket in the project\r\nwhere the logs were generated.\r\nIf you route Admin Activity audit logs and System Event audit logs to a different project, then those logs don't\r\npass through the _Default or _Required sink of the destination project. Therefore, these logs aren't stored in\r\nthe _Default log bucket or the _Required log bucket of the destination project. To store these logs, create a log\r\nsink in the destination project. For more information, see Route logs to supported destinations.\r\nThe _Default buckets, by default, store any enabled Data Access audit logs as well as Policy Denied audit logs.\r\nTo prevent Data Access audit logs from being stored in the _Default buckets, you can disable them. To prevent\r\nany Policy Denied audit logs from being stored in the _Default buckets, you can exclude them by modifying\r\ntheir sinks' filters.\r\nYou can also route your audit log entries to user-defined Cloud Logging buckets at the Google Cloud project level\r\nor to supported destinations outside of Logging using sinks. For instructions on routing logs, see Route logs to\r\nsupported destinations.\r\nWhen configuring your log sinks' filters, you need to specify the audit log types you want to route; for filtering\r\nexamples, see Security logging queries.\r\nIf you want to route audit log entries for a Google Cloud organization, folder, or billing account, and for their\r\nchildren, see Aggregated sinks overview.\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 8 of 9\n\nAudit log retention\r\nFor details on how long log entries are retained by Logging, see the retention information in Quotas and limits:\r\nLogs retention periods.\r\nAccess control\r\nIAM permissions and roles determine your ability to access audit logs data in the Logging API, the Logs Explorer,\r\nand the Google Cloud CLI.\r\nFor detailed information about the IAM permissions and roles you might need, see Access control with IAM.\r\nQuotas and limits\r\nFor details on logging usage limits, including the maximum sizes of audit logs, see Quotas and limits.\r\nPricing\r\nFor pricing information, see Google Cloud Observability pricing page. If you route log data to other Google Cloud\r\nservices, then see the following documents:\r\nCloud Storage pricing\r\nBigQuery pricing\r\nPub/Sub pricing\r\nWhat's next\r\nLearn how to read and understand audit logs.\r\nLearn how to enable Data Access audit logs.\r\nReview best practices for Cloud Audit Logs.\r\nLearn about Access Transparency, which provides logs of actions taken by Google Cloud staff when\r\naccessing your Google Cloud content.\r\nSource: https://cloud.google.com/logging/docs/audit#admin-activity\r\nhttps://cloud.google.com/logging/docs/audit#admin-activity\r\nPage 9 of 9",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"MITRE"
	],
	"references": [
		"https://cloud.google.com/logging/docs/audit#admin-activity"
	],
	"report_names": [
		"audit#admin-activity"
	],
	"threat_actors": [],
	"ts_created_at": 1775441439,
	"ts_updated_at": 1775791236,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/7c2f0260c635ea9773d846a067031ae635ad899c.pdf",
		"text": "https://archive.orkl.eu/7c2f0260c635ea9773d846a067031ae635ad899c.txt",
		"img": "https://archive.orkl.eu/7c2f0260c635ea9773d846a067031ae635ad899c.jpg"
	}
}