Audit logging in GCP - Step-by-Step Execution

Process Flow - Audit logging

User or Service Action

↓

Request sent to GCP API

↓

Audit Log Generated

↓

Log Entry Stored in Cloud Logging

↓

Admin or System Reviews Logs

↓

Alerts or Reports Created if Needed

This flow shows how user or service actions in GCP generate audit logs that are stored and reviewed for security and compliance.

Execution Sample

GCP

gcloud logging read "resource.type=gce_instance AND protoPayload.methodName=\"google.compute.instances.insert\"" --limit 3

This command reads the last 3 audit log entries for VM instance creation in a GCP project.

Process Table

Step	Action	Command/Operation	Result/Output
1	User creates VM instance	gcloud compute instances create my-vm	Request sent to GCP API
2	GCP generates audit log	Internal system	Audit log entry created with methodName google.compute.instances.insert
3	Store log entry	Cloud Logging service	Log entry saved in project logs
4	Read audit logs	gcloud logging read "resource.type=gce_instance AND protoPayload.methodName=\"google.compute.instances.insert\"" --limit 3	Displays last 3 VM creation audit log entries
5	Review logs	Admin views logs in Cloud Console or CLI	Logs show who created VM, when, and request details
6	Exit	No more logs to read	Command ends

💡 No more matching audit log entries to display, command completes

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Audit Log Entry	None	None	Created with VM creation details	Stored in Cloud Logging	Retrieved by gcloud logging read	Displayed to user

Key Moments - 3 Insights

Why don't I see audit logs immediately after creating a resource?

Audit logs may take a few seconds to appear after the action (see Step 2 and 3 in execution_table). The system needs time to generate and store the log entry.

How do I filter audit logs for specific actions?

Use filters like protoPayload.methodName in the gcloud logging read command (Step 4). This targets logs for specific API calls.

Can audit logs show who performed an action?

Yes, audit logs include the identity of the user or service account that made the request (Step 5). This helps track accountability.

Visual Quiz - 3 Questions

Look at the execution_table, at which step is the audit log entry created?

A Step 2

B Step 4

C Step 1

D Step 5

💡 Hint

Check the 'Result/Output' column in Step 2 for when the audit log is generated.

According to variable_tracker, what is the state of the Audit Log Entry after Step 3?

A None

B Stored in Cloud Logging

C Created with VM creation details

D Retrieved by gcloud logging read

💡 Hint

Look at the 'After Step 3' column for the Audit Log Entry variable.

If you want to see audit logs for deleting a VM instead of creating, which part of the command changes?

A Change --limit 3 to --limit 5

B Change resource.type=project to resource.type=vm_instance

C Change protoPayload.methodName to google.compute.instances.delete

D Change gcloud logging read to gcloud compute instances delete

💡 Hint

Refer to Step 4 command filter for protoPayload.methodName usage.

Concept Snapshot

Audit logging in GCP records user and service actions.
Logs are generated after API calls and stored in Cloud Logging.
Use gcloud logging read with filters to view audit logs.
Audit logs include who did what and when.
Logs help with security, compliance, and troubleshooting.

Full Transcript

Audit logging in Google Cloud Platform tracks actions by users and services. When you perform an action like creating a VM, GCP generates an audit log entry recording details of that action. This log is stored in Cloud Logging. You can use the gcloud logging read command with filters to find specific audit logs, such as those for VM creation. Audit logs show who performed the action, when it happened, and other request details. This helps administrators monitor activity and maintain security. Logs may take a few seconds to appear after the action. Filtering logs by methodName helps focus on particular operations.