Audit logging in GCP - Step-by-Step Execution

Process Flow - Audit logging

User or Service Action

↓

Request sent to GCP API

↓

Audit Log Generated

↓

Log Entry Stored in Cloud Logging

↓

Admin or System Reviews Logs

↓

Alerts or Reports Created if Needed

This flow shows how user or service actions in GCP generate audit logs that are stored and reviewed for security and compliance.

Execution Sample

GCP

gcloud logging read "resource.type=gce_instance AND protoPayload.methodName=\"google.compute.instances.insert\"" --limit 3

This command reads the last 3 audit log entries for VM instance creation in a GCP project.

Process Table

Step	Action	Command/Operation	Result/Output
1	User creates VM instance	gcloud compute instances create my-vm	Request sent to GCP API
2	GCP generates audit log	Internal system	Audit log entry created with methodName google.compute.instances.insert
3	Store log entry	Cloud Logging service	Log entry saved in project logs
4	Read audit logs	gcloud logging read "resource.type=gce_instance AND protoPayload.methodName=\"google.compute.instances.insert\"" --limit 3	Displays last 3 VM creation audit log entries
5	Review logs	Admin views logs in Cloud Console or CLI	Logs show who created VM, when, and request details
6	Exit	No more logs to read	Command ends

💡 No more matching audit log entries to display, command completes

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Audit Log Entry	None	None	Created with VM creation details	Stored in Cloud Logging	Retrieved by gcloud logging read	Displayed to user

Key Moments - 3 Insights

Why don't I see audit logs immediately after creating a resource?

Audit logs may take a few seconds to appear after the action (see Step 2 and 3 in execution_table). The system needs time to generate and store the log entry.

How do I filter audit logs for specific actions?

Use filters like protoPayload.methodName in the gcloud logging read command (Step 4). This targets logs for specific API calls.

Can audit logs show who performed an action?

Yes, audit logs include the identity of the user or service account that made the request (Step 5). This helps track accountability.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the audit log entry created?

A Step 2

B Step 4

C Step 1

D Step 5

💡 Hint

Check the 'Result/Output' column in Step 2 for when the audit log is generated.

According to variable_tracker, what is the state of the Audit Log Entry after Step 3?

A None

B Stored in Cloud Logging

C Created with VM creation details

D Retrieved by gcloud logging read

💡 Hint

Look at the 'After Step 3' column for the Audit Log Entry variable.

If you want to see audit logs for deleting a VM instead of creating, which part of the command changes?

A Change --limit 3 to --limit 5

B Change resource.type=project to resource.type=vm_instance

C Change protoPayload.methodName to google.compute.instances.delete

D Change gcloud logging read to gcloud compute instances delete

💡 Hint

Refer to Step 4 command filter for protoPayload.methodName usage.

Concept Snapshot

Audit logging in GCP records user and service actions.
Logs are generated after API calls and stored in Cloud Logging.
Use gcloud logging read with filters to view audit logs.
Audit logs include who did what and when.
Logs help with security, compliance, and troubleshooting.

Full Transcript

Audit logging in Google Cloud Platform tracks actions by users and services. When you perform an action like creating a VM, GCP generates an audit log entry recording details of that action. This log is stored in Cloud Logging. You can use the gcloud logging read command with filters to find specific audit logs, such as those for VM creation. Audit logs show who performed the action, when it happened, and other request details. This helps administrators monitor activity and maintain security. Logs may take a few seconds to appear after the action. Filtering logs by methodName helps focus on particular operations.

Practice

1. What is the main purpose of audit logging in Google Cloud Platform?

easy

A. To create virtual machines

B. To record actions for security and troubleshooting

C. To speed up network traffic

D. To increase storage capacity automatically

Solution

1. Step 1: Understand audit logging function

   Audit logging captures user and system actions in your cloud environment.

2. Step 2: Identify the purpose

   This helps with security monitoring and troubleshooting issues.

3. Final Answer:

   To record actions for security and troubleshooting -> Option B

4. Quick Check:

   Audit logging = record actions [OK]

Hint: Audit logs track actions for security and fixes [OK]

Common Mistakes:

• Confusing audit logs with storage or network features
• Thinking audit logs create resources
• Assuming audit logs improve performance

2. Which command correctly creates a sink to export audit logs to a Cloud Storage bucket named my-logs-bucket?

easy

A. gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\""

B. gcloud logging create sink my-sink storage://my-logs-bucket

C. gcloud logs create sink my-sink gs://my-logs-bucket

D. gcloud logging sinks add my-sink storage.googleapis.com/my-logs-bucket

Solution

1. Step 1: Identify correct gcloud command syntax

   The correct command uses gcloud logging sinks create followed by sink name and destination URL.

2. Step 2: Verify destination format

   Cloud Storage buckets use storage.googleapis.com/BUCKET_NAME format.

3. Final Answer:

   gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\"" -> Option A

4. Quick Check:

   Correct sink creation syntax = gcloud logging sinks create my-sink storage.googleapis.com/my-logs-bucket --log-filter="resource.type=\"gce_instance\"" [OK]

Hint: Use 'gcloud logging sinks create' with full storage URL [OK]

Common Mistakes:

• Using wrong command verbs like 'create sink' or 'add sink'
• Incorrect bucket URL format (missing storage.googleapis.com)
• Using 'gs://' instead of full URL

3. Given this filter in a sink configuration: resource.type="bigquery_resource" AND protoPayload.methodName="jobservice.jobcompleted", what logs will be exported?

medium

A. Only logs from Compute Engine instances

B. All error logs from Cloud Storage

C. All BigQuery job completion audit logs

D. All network traffic logs

Solution

1. Step 1: Analyze the resource type filter

   The filter specifies resource.type="bigquery_resource", so logs relate to BigQuery.

2. Step 2: Analyze the method name filter

   protoPayload.methodName="jobservice.jobcompleted" means only job completion events are included.

3. Final Answer:

   All BigQuery job completion audit logs -> Option C

4. Quick Check:

   Filter matches BigQuery job completions = All BigQuery job completion audit logs [OK]

Hint: Filter resource and method to find exported logs [OK]

Common Mistakes:

• Confusing resource types with unrelated services
• Ignoring methodName filter
• Assuming all logs are exported

4. You created a sink to export audit logs to a Pub/Sub topic but logs are not appearing. What is the most likely cause?

medium

A. The sink lacks permission to publish to the Pub/Sub topic

B. The sink filter is too broad and excludes all logs

C. Audit logging is disabled in the project

D. The Pub/Sub topic name is misspelled in the sink

Solution

1. Step 1: Check sink permissions

   Sinks need permission to write to destinations like Pub/Sub topics.

2. Step 2: Identify common permission issue

   If logs do not appear, the sink likely lacks the pubsub.publisher role on the topic.

3. Final Answer:

   The sink lacks permission to publish to the Pub/Sub topic -> Option A

4. Quick Check:

   Missing sink permissions = The sink lacks permission to publish to the Pub/Sub topic [OK]

Hint: Check sink destination permissions first when logs missing [OK]

Common Mistakes:

• Assuming audit logging is off without checking
• Blaming filter without verifying permissions
• Ignoring typo in topic name

5. You want to export only admin activity audit logs for Cloud Storage buckets in your project to a BigQuery dataset for analysis. Which sink filter is correct?

hard

A. resource.type="gcs_bucket" AND severity="ERROR"

B. logName:"cloudaudit.googleapis.com/activity" AND resource.type="gcs_bucket" AND protoPayload.methodName:"storage.objects.create"

C. logName:"cloudaudit.googleapis.com/data_access" AND resource.type="gcs_bucket"

D. logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket"

Solution

1. Step 1: Identify admin activity logs

   Admin activity logs use logName:"cloudaudit.googleapis.com/admin_activity".

2. Step 2: Filter for Cloud Storage buckets

   Use resource.type="gcs_bucket" to target storage buckets.

3. Step 3: Confirm filter matches requirement

   logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" correctly combines admin activity logs with GCS buckets.

4. Final Answer:

   logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" -> Option D

5. Quick Check:

   Admin activity + GCS bucket filter = logName:"cloudaudit.googleapis.com/admin_activity" AND resource.type="gcs_bucket" [OK]

Hint: Use admin_activity logName for admin logs [OK]

Common Mistakes:

• Using data_access logs instead of admin_activity
• Filtering by specific methods unnecessarily
• Confusing severity with log type