This document provides a conceptual overview of Cloud Audit Logs.

Google Cloud services write audit logs that record administrative activitiesand accesses within your Google Cloud resources. Audit logs help youanswer "who did what, where, and when?" within your Google Cloud resourceswith the same level of transparency as in on-premises environments. Enablingaudit logs helps your security, auditing, and compliance entities monitorGoogle Cloud data and systems for possible vulnerabilities or externaldata misuse.

Google Cloud services producing audit logs

For a list of Google Cloud services that provide audit logs, seeGoogle Cloud services with audit logs. AllGoogle Cloud services will eventually provide audit logs.

Google Cloud MCP servers write Data Access audit logs. Data Access audit logswritten by Google Cloud MCP servers API calls are service-specific and use the formatSERVICE_NAME.googleapis.com/mcp. You can enable these Data Access logsby turning on audit logging formcp.googleapis.com intheIAMAuditConfig object.For more information about audit logging for Google Cloud MCP servers, seeGoogle Cloud MCP servers audit logging.

For an overview of Google Workspace audit logs, seeAudit logs for Google Workspace.

Required roles

To view audit logs, you must have the appropriateIdentity and Access Management (IAM) permissions and roles:

• To get the permissions that you need to get read-only access to Admin Activity, Policy Denied, andSystem Event audit logs, ask your administrator to grant you theLogs Viewer (roles/logging.viewer) IAM role on your project.

  If you have only the Logs Viewer role(roles/logging.viewer), then youcannot view Data Access audit logs that are in the_Default bucket.

• To get the permissions that you need to get access to all logs in the_Required and_Defaultbuckets, including Data Access logs, ask your administrator to grant you thePrivate Logs Viewer (roles/logging.privateLogViewer) IAM role on your project.

  The Private Logs Viewer role(roles/logging.privateLogViewer) includes thepermissions contained in the Logs Viewer role (roles/logging.viewer),and those necessary to read Data Access audit logs in the_Default bucket.

For more information about the IAM permissions and roles thatapply to audit logs data, seeAccess control with IAM.

Types of audit logs

Cloud Audit Logs provides the following audit logs for eachGoogle Cloud project, folder, and organization:

• Admin Activity audit logs
• Data Access audit logs
• System Event audit logs
• Policy Denied audit logs

For a list of services that write Admin Activity audit logs and detailedinformation about which activities generate those logs, seeGoogle Cloud services with audit logs.

Data Access audit logs

Data Access audit logs are log entries written by API calls that read theconfiguration or metadata of resources. They are also written by user-drivenAPI calls that create, modify, or read user-provided resource data.

Publicly available resources that have the Identity and Access Management policiesallAuthenticatedUsers orallUsers don't generate audit logs. Resourcesthat can be accessed without logging into a Google Cloud,Google Workspace, Cloud Identity, or Drive Enterprise account don'tgenerate audit logs. This helps protect end-user identities and information.

Data Access audit logs—except forBigQuery Data Access audit logs—are disabled by default becauseaudit logs can be quite large. If you want DataAccess audit logs to be written for Google Cloud services other thanBigQuery, you must explicitly enable them. Data Access audit logsare written to the Google Cloud project whose data is accessed.Enabling these logs might result in your Google Cloud project beingcharged for the additional logs usage. For instructions on enabling andconfiguring Data Access audit logs, seeEnable Data Access audit logs.

For a list of services that write Data Access audit logs and detailedinformation about which activities generate those logs, seeGoogle Cloud services with audit logs.

Data Access audit logs are stored in the_Default log bucket unlessyou've routed them elsewhere. For more information, see theStoring and routing audit logssection of this page.

System Event audit logs

System Event audit logs are log entries written by Google Cloud systemsthat modify the configuration of resources. System Event audit logs aren'tdriven by direct user action. For example, a System Event audit log is writtenwhen VMs are automatically added to or removed from managed instance groups(MIGs) due to autoscaling.

System Event audit logs are always written; you can't configure, exclude, ordisable them.

For a list of services that write System Event audit logs and detailedinformation about which activities generate those logs, seeGoogle Cloud services with audit logs.

Policy Denied audit logs

Policy Denied audit logs are log entries written when a Google Cloud servicedenies access to a user orservice account because of asecurity policy violation.

Policy Denied audit logs are generated by default and yourGoogle Cloud project is charged for the logs storage. You can't disable PolicyDenied audit logs, but you can useexclusion filters to prevent PolicyDenied audit logs from being stored in Cloud Logging.

For a list of services that write Policy Denied audit logs and detailedinformation about which activities generate those logs, seeGoogle Cloud services with audit logs.

Audit log entry structure

Every audit log entry in Cloud Logging is an object of typeLogEntry. What distinguishes an audit log entry from other logentries is theprotoPayload field; this field contains anAuditLog object that stores the audit logging data.

To understand how to read and interpret audit log entries, and for a sample ofan audit log entry, seeUnderstanding audit logs.

Log name

Cloud Audit Logs log names include the following:

• Resource identifiers indicating the Google Cloud project orother Google Cloud entity that owns the audit logs.

• The stringcloudaudit.googleapis.com.

• A string that indicates whether the log contains Admin Activity, Data Access,Policy Denied, or System Event audit logging data.

The following are the audit log names, including variables for the resourceidentifiers:

projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivityprojects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_accessprojects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fsystem_eventprojects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fpolicyfolders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivityfolders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_accessfolders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fsystem_eventfolders/FOLDER_ID/logs/cloudaudit.googleapis.com%2FpolicybillingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2FactivitybillingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fdata_accessbillingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fsystem_eventbillingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fpolicyorganizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivityorganizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_accessorganizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fsystem_eventorganizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fpolicy

Caller identities in audit logs

Audit logs record the identity that performed the logged operations on theGoogle Cloud resource. The caller's identity is held in theAuthenticationInfo field ofAuditLog objects.

Audit logging doesn't redact the caller's principal email address for anyaccess that succeeds or for any write operation.

For read-only operations that fail with a "permission denied" error,Audit Logging might redact the caller's principal email address unless thecaller is a service account.

In addition to the conditions listed above, the following applies to certainGoogle Cloud services:

• Legacy App Engine API: Identities aren'tcollected.

• BigQuery: Calleridentities and IP addresses, as well as some resource names, are redactedfrom the audit logs, unless certain conditions are met.

• Cloud Storage: When Cloud Storageusage logs are enabled, Cloud Storage writes usage data to theCloud Storage bucket, which generates Data Access audit logs for thebucket. The generated Data Access audit log has its caller identityredacted.

• Firestore: If a JSON Web Token(JWT) was used for third-party authentication, thethirdPartyPrincipalfield includes the token's header and payload. For example, audit logs forrequests authenticated withFirebase Authentication include thatrequest'sauth token.

• VPC Service Controls: ForPolicy Denied audit logs, the following redaction occurs:

  • Parts of the caller email addresses might be redacted and replaced bythree period characters....

  • Some caller email addresses belonging to the domaingoogle.com areredacted and replaced bygoogle-internal.

• Organization Policy:Parts of the caller email addresses might be redacted and replaced bythree period characters....

IP address of the caller in audit logs

The IP address of the caller is held in theRequestMetadata.callerIp field oftheAuditLog object:

• For a caller from the internet, the address is a public IPv4 or IPv6address.
• For calls made from inside the internal production network from oneGoogle Cloud service to another, thecallerIp is redacted to "private".
• For a caller from a Compute Engine VM with a external IP address, thecallerIp is the external address of the VM.
• For a caller from a Compute Engine VM without a external IP address, ifthe VM is in the same organization or project as the accessed resource, thencallerIp is the VM's internal IPv4 address. Otherwise, thecallerIp isredacted to "gce-internal-ip". For more information, seeVPC network overview.

Viewing audit logs

You can query for all audit logs or you can query for logs by theiraudit log name. The audit log name includes theresource identifierof the Google Cloud project, folder, billing account, ororganization for which you want to view audit logging information.Your queries can specify indexedLogEntry fields.For more information about querying your logs, seeBuild queries in the Logs Explorer

The Logs Explorer lets you view filter individual log entries. If you wantto use SQL to analyze groups of log entries, then use theLog Analyticspage. For more information, see:

• Query and view logs in Log Analytics.
• Sample queries for security insights.
• Chart query results.

Most audit logs can be viewed in Cloud Logging by using theGoogle Cloud console, the Google Cloud CLI, or the Logging API.However, for audit logs related to billing, you can only use theGoogle Cloud CLI or the Logging API.

gcloud logging read "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" \    --project=PROJECT_ID

gcloud logging read "logName : folders/FOLDER_ID/logs/cloudaudit.googleapis.com" \    --folder=FOLDER_ID

gcloud logging read "logName : organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com" \    --organization=ORGANIZATION_ID

gcloud logging read "logName : billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com" \    --billing-account=BILLING_ACCOUNT_ID

Storing and routing audit logs

Cloud Logging useslog buckets ascontainers that store and organize your logs data. For each billing account,Google Cloud project, folder, and organization, Loggingautomatically creates two log buckets,_Required and_Default, andcorrespondingly namedsinks.

Cloud Logging_Required buckets store Admin Activity audit logsand System Event audit logs. You can't prevent Admin Activity or System Eventaudit logs from being stored. You also can't configure the sink that routeslog entries to the_Required buckets.

Admin Activity audit logs and System Event audit logs are always stored in the_Required bucket in the project where the logs were generated.

If you route Admin Activity audit logs and System Event audit logs to adifferent project, then those logs don't pass through the_Default or_Required sink of the destination project. Therefore, these logs aren't storedin the_Default log bucket or the_Required log bucket of the destinationproject. To store these logs, create a log sink in the destination project.For more information, seeRoute logs to supported destinations.

The_Default buckets, by default, store any enabled Data Accessaudit logs as well as Policy Denied audit logs. To prevent Data Access auditlogs from being stored in the_Default buckets, you can disable them. Toprevent any Policy Denied audit logs from being stored in the_Defaultbuckets, you can exclude them by modifying their sinks' filters.

You can also route your audit log entries to user-definedCloud Logging buckets at the Google Cloud project level or to supporteddestinations outside of Logging using sinks. For instructionson routing logs, seeRoute logs to supported destinations.

When configuring your log sinks' filters, you need to specify the audit logtypes you want to route; for filtering examples, seeSecurity logging queries.

If you want to route audit log entries for a Google Cloud organization,folder, or billing account, and for their children, seeAggregated sinks overview.

Audit log retention

For details on how long log entries are retained by Logging,see the retention information inQuotas and limits: Logs retention periods.

Access control

IAM permissions and roles determine your ability to access auditlogs data in theLogging API, theLogs Explorer, and theGoogle Cloud CLI.

For detailed information about the IAM permissions and roles youmight need, seeAccess control with IAM.

Quotas and limits

For details on logging usage limits, including the maximum sizes of audit logs,seeQuotas and limits.

Pricing

For pricing information, seeGoogle Cloud Observability pricing page. If you route log data toother Google Cloud services, then see the following documents:

• Cloud Storage pricing
• BigQuery pricing
• Pub/Sub pricing

What's next

• Learn how toread and understand audit logs.
• Learn how toenable Data Access audit logs.
• Reviewbest practices forCloud Audit Logs.

• Learn aboutAccess Transparency,which provides logs of actions taken by Google Cloud staff when accessingyour Google Cloud content.