Data access logs in GCP - Step-by-Step Execution

Process Flow - Data access logs

Enable Data Access Logs

↓

Log Generated on Data Access

↓

Log Stored in Logging Service

↓

User Views Logs for Audit or Debug

↓

Use Logs to Monitor or Investigate

Data access logs start when logging is enabled, then logs are created on data access events, stored securely, and finally reviewed for auditing or troubleshooting.

Execution Sample

GCP

gcloud logging sinks create my-sink storage.googleapis.com/my-bucket --log-filter="resource.type=bigquery_resource AND protoPayload.methodName=\"jobservice.jobcompleted\""

This command creates a sink to export BigQuery data access logs to a Cloud Storage bucket.

Process Table

Step	Action	Input/Condition	Result/Output	Next Step
1	Enable data access logs	Set audit config in IAM or Admin Console	Data access logs start recording	2
2	Access data resource	User runs query or reads data	Log entry created for access event	3
3	Log entry stored	Log entry sent to Cloud Logging	Log stored securely and indexed	4
4	Create sink for logs	Define sink with filter and destination	Logs exported to chosen storage	5
5	View logs	User queries logs in Cloud Console or CLI	Logs displayed for audit or debug	6
6	Analyze logs	User reviews logs for anomalies or usage	Insights gained for security or billing	End

💡 Logs are continuously generated and stored; process ends when user finishes analysis.

Status Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 5	Final
Data Access Logs Enabled	False	True	True	True	True	True
Log Entry Created	None	Created	Stored	Stored	Exported	Viewed
Sink Configuration	None	None	None	Created	Created	Created
User Log View	None	None	None	None	Viewed	Viewed

Key Moments - 3 Insights

Why do logs only appear after enabling data access logs?

Because as shown in execution_table step 1, logs start recording only after enabling the audit config; before that, no logs are generated.

What happens if no sink is created for logs?

Logs remain in Cloud Logging but are not exported; step 4 shows sink creation is needed to export logs to storage or other destinations.

Can logs be viewed before they are stored?

No, logs must be stored first (step 3) before they can be viewed or exported (steps 5 and 6).

Visual Quiz - 3 Questions

Look at the execution_table, at which step are logs exported to storage?

A Step 5

B Step 3

C Step 4

D Step 6

💡 Hint

Check the 'Result/Output' column for step 4 about logs exported to chosen storage.

According to variable_tracker, when does 'Log Entry Created' change from None to Created?

A After Step 1

B After Step 2

C After Step 3

D After Step 4

💡 Hint

Look at the 'Log Entry Created' row and see when it first changes from None.

If data access logs are not enabled, what will be the state of 'Data Access Logs Enabled' in variable_tracker?

A False

B True

C Created

D Viewed

💡 Hint

Refer to the 'Data Access Logs Enabled' row in variable_tracker at Start.

Concept Snapshot

Data Access Logs in GCP:
- Enable audit logging for data access in IAM or Admin Console.
- Logs record every data read or query event.
- Logs are stored in Cloud Logging automatically.
- Create sinks to export logs to storage or BigQuery.
- View and analyze logs for auditing and troubleshooting.

Full Transcript

Data access logs in Google Cloud Platform start when you enable audit logging for data access. Once enabled, every time someone reads or queries data, a log entry is created. These logs are stored securely in Cloud Logging. You can create sinks to export these logs to other storage like Cloud Storage or BigQuery for long-term retention or analysis. Finally, you can view and analyze these logs in the Cloud Console or via command line to monitor usage, audit access, or troubleshoot issues. The process flow begins with enabling logs, continues with log creation on data access, storing logs, exporting via sinks, and ends with user viewing and analyzing logs.