Cloud Resource Manager

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for cloudresourcemanager.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	N
CreateFolder	Creates a folder in the resource hierarchy.	activity	N	N
DeleteFolder	Requests deletion of a folder.	activity	N	N
MoveFolder	Moves a folder under a new resource parent.	activity	N	N
GetIamPolicy		data_access	Y	N
InsertProjectOwnershipInvite	Invites an external principal to become an owner of a Google Cloud project.	activity	N	Y
CreateProject	Creates a project resource.	activity	N	N
DeleteProject	Marks the project identified by the specified name as deleted.	activity	N	N
MoveProject	Moves a project under a new resource parent.	activity	N	N
SetIamPolicy	Sets the IAM access control policy for the specified project, replaces any existing policy.	activity	Y	Y
ClearOrgPolicy	Clear an organization policy from a resource (bare ClearOrgPolicy log form).	activity	Y	N
GetOrgPolicy	Read an effective organization policy (bare GetOrgPolicy log form).	data_access	Y	N
GetProject	Read project metadata (bare GetProject log form).	data_access	Y	N
ListOrgPolicies	List organization policies set on a resource (bare ListOrgPolicies log form).	data_access	Y	N
SetOrgPolicy	Set an organization policy on a resource (bare SetOrgPolicy log form).	activity	Y	N

any: cloudresourcemanager.googleapis.com (any method)

ServiceName: cloudresourcemanager.googleapis.com

Description

Catch-all entry for cloudresourcemanager.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

CreateFolder

ServiceName: cloudresourcemanager.googleapis.com

Description

Creates a folder in the resource hierarchy.

DeleteFolder

ServiceName: cloudresourcemanager.googleapis.com

Description

Requests deletion of a folder.

MoveFolder

ServiceName: cloudresourcemanager.googleapis.com

Description

Moves a folder under a new resource parent.

GetIamPolicy

ServiceName: cloudresourcemanager.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "8c6jcad50pc",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "000000000000.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "resourcemanager.projects.getIamPolicy",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "GetIamPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.GetIamPolicyRequest",
      "options": {
        "requestedPolicyVersion": 3
      },
      "resource": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.projects.remove-iam-policy-binding invocation-id/779d4cf4b46d44069c73afd62409537d environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-07-02T02:37:16.313319666Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-07-02T02:37:15.161783Z"
}

InsertProjectOwnershipInvite

ServiceName: cloudresourcemanager.googleapis.com

Description

Invites an external principal to become an owner of a Google Cloud project.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`protoPayload.response.error` (panther rule field)	is_null		1 rule	panther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GCP External User Ownership Invite source high: This rule detects when an external user is invited as an owner of a GCP project using the InsertProjectOwnershipInvite event.

CreateProject

ServiceName: cloudresourcemanager.googleapis.com

Description

Creates a project resource.

DeleteProject

ServiceName: cloudresourcemanager.googleapis.com

Description

Marks the project identified by the specified name as deleted.

MoveProject

ServiceName: cloudresourcemanager.googleapis.com

Description

Moves a project under a new resource parent.

SetIamPolicy

ServiceName: cloudresourcemanager.googleapis.com

Description

Sets the IAM access control policy for the specified project, replaces any existing policy.

Example Audit Log Entry #

{
  "insertId": "ivhl39e1vgvu",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "000000000000.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "resourcemanager.projects.setIamPolicy",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      },
      {
        "granted": true,
        "permission": "resourcemanager.projects.setIamPolicy",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "SetIamPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.SetIamPolicyRequest",
      "policy": {
        "auditConfigs": [
          {
            "auditLogConfigs": [
              {
                "logType": "ADMIN_READ"
              },
              {
                "logType": "DATA_READ"
              },
              {
                "logType": "DATA_WRITE"
              }
            ],
            "service": "allServices"
          }
        ],
        "bindings": [
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-gae-service.iam.gserviceaccount.com"
            ],
            "role": "roles/appengine.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:000000000000@cloudbuild.gserviceaccount.com"
            ],
            "role": "roles/cloudbuild.builds.builder"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-sa-cloudbuild.iam.gserviceaccount.com"
            ],
            "role": "roles/cloudbuild.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:000000000000@cloudservices.gserviceaccount.com"
            ],
            "role": "roles/compute.instanceGroupManagerServiceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@compute-system.iam.gserviceaccount.com"
            ],
            "role": "roles/compute.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-sa-gkenode.iam.gserviceaccount.com"
            ],
            "role": "roles/container.defaultNodeServiceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@container-engine-robot.iam.gserviceaccount.com"
            ],
            "role": "roles/container.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@containerregistry.iam.gserviceaccount.com"
            ],
            "role": "roles/containerregistry.ServiceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@dlp-api.iam.gserviceaccount.com"
            ],
            "role": "roles/dlp.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-sa-firestore.iam.gserviceaccount.com"
            ],
            "role": "roles/firestore.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-sa-logging.iam.gserviceaccount.com"
            ],
            "role": "roles/logging.serviceAgent"
          },
          {
            "members": [
              "user:user@example.com"
            ],
            "role": "roles/owner"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@gcp-sa-pubsub.iam.gserviceaccount.com"
            ],
            "role": "roles/pubsub.serviceAgent"
          },
          {
            "members": [
              "serviceAccount:service-000000000000@serverless-robot-prod.iam.gserviceaccount.com"
            ],
            "role": "roles/run.serviceAgent"
          }
        ],
        "etag": "BwZVlxytAJU="
      },
      "resource": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.projects.remove-iam-policy-binding invocation-id/eb7eb87595cf47678294f88ce1290f89 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "response": {
      "@type": "type.googleapis.com/google.iam.v1.Policy",
      "auditConfigs": [
        {
          "auditLogConfigs": [
            {
              "logType": "ADMIN_READ"
            },
            {
              "logType": "DATA_READ"
            },
            {
              "logType": "DATA_WRITE"
            }
          ],
          "service": "allServices"
        }
      ],
      "bindings": [
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-gae-service.iam.gserviceaccount.com"
          ],
          "role": "roles/appengine.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:000000000000@cloudbuild.gserviceaccount.com"
          ],
          "role": "roles/cloudbuild.builds.builder"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-sa-cloudbuild.iam.gserviceaccount.com"
          ],
          "role": "roles/cloudbuild.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:000000000000@cloudservices.gserviceaccount.com"
          ],
          "role": "roles/compute.instanceGroupManagerServiceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@compute-system.iam.gserviceaccount.com"
          ],
          "role": "roles/compute.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-sa-gkenode.iam.gserviceaccount.com"
          ],
          "role": "roles/container.defaultNodeServiceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@container-engine-robot.iam.gserviceaccount.com"
          ],
          "role": "roles/container.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@containerregistry.iam.gserviceaccount.com"
          ],
          "role": "roles/containerregistry.ServiceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@dlp-api.iam.gserviceaccount.com"
          ],
          "role": "roles/dlp.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-sa-firestore.iam.gserviceaccount.com"
          ],
          "role": "roles/firestore.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-sa-logging.iam.gserviceaccount.com"
          ],
          "role": "roles/logging.serviceAgent"
        },
        {
          "members": [
            "user:user@example.com"
          ],
          "role": "roles/owner"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@gcp-sa-pubsub.iam.gserviceaccount.com"
          ],
          "role": "roles/pubsub.serviceAgent"
        },
        {
          "members": [
            "serviceAccount:service-000000000000@serverless-robot-prod.iam.gserviceaccount.com"
          ],
          "role": "roles/run.serviceAgent"
        }
      ],
      "etag": "BwZVlxzIWcI="
    },
    "serviceData": {
      "@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
      "policyDelta": {
        "bindingDeltas": [
          {
            "action": "REMOVE",
            "member": "serviceAccount:dw-harn-crm-3c1c71@example-project-id.iam.gserviceaccount.com",
            "role": "roles/browser"
          }
        ]
      }
    },
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-07-02T01:56:12.284414117Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "NOTICE",
  "timestamp": "2026-07-02T01:56:11.049050Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

Field	Kind	Value	Rules	Vendors
`Severity` (kusto rule field)	eq	`NOTICE`	1 rule	kusto

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Kusto #

GCP Audit Logs - Data Access Logging Exemption Added for Principal source high: Detects when a principal (user or service account) is exempted from GCP data access audit logging. This is a critical security event as it reduces visibility into privileged operations and may indicate an attempt to hide malicious activity. Adversaries may exempt their accounts from audit logging to evade detection while performing reconnaissance, privilege escalation, or data exfiltration. This rule monitors SetIamPolicy operations that add audit log exemptions for ADMIN_READ, DATA_READ, or DATA_WRITE log types.T1078, T1078.004, T1562, T1562.008

YARA-L #

GCP Cloud Audit Logging Removed From All Services source high: Detect when GCP Cloud Audit logs are removed from all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.T1562
GCP Exempt Principals From Audit Log source high: Detect when GCP Cloud Audit logs are exempted for principals in all services at project or organization level. Audit logging helps organizations maintain security and minimize risk.T1562

ClearOrgPolicy

ServiceName: cloudresourcemanager.googleapis.com

Description

Clear an organization policy from a resource (bare ClearOrgPolicy log form).

Example Audit Log Entry #

{
  "insertId": "eh7jj6dk0zi",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": false,
        "permission": "orgpolicy.policy.set",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "ClearOrgPolicy",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v1.ClearOrgPolicyRequest",
      "constraint": "constraints/compute.disableSerialPortAccess",
      "resource": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.resource-manager.org-policies.delete invocation-id/9876b625d1c343d58b5e096b69e7c88e environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {
      "code": 7,
      "message": "An unexpected error occurred. Please try again later."
    }
  },
  "receiveTimestamp": "2026-06-29T15:28:57.540612952Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T15:28:56.387147Z"
}

GetOrgPolicy

ServiceName: cloudresourcemanager.googleapis.com

Description

Read an effective organization policy (bare GetOrgPolicy log form).

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-b2nszfd65km",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "orgpolicy.policy.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "GetOrgPolicy",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v1.GetOrgPolicyRequest",
      "constraint": "constraints/compute.requireOsLogin",
      "resource": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.resource-manager.org-policies.describe invocation-id/31467130bbf74e0eb9de4fb626c24732 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:21:30.309427407Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:21:29.240331Z"
}

GetProject

ServiceName: cloudresourcemanager.googleapis.com

Description

Read project metadata (bare GetProject log form).

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "vy3q0do68s",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "resourcemanager.projects.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "GetProject",
    "request": {
      "@type": "type.googleapis.com/google.cloudresourcemanager.v1.GetProjectRequest",
      "projectId": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.projects.describe invocation-id/9d8da02394c84b52b467166f36017080 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:49.688894398Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:48.866163Z"
}

ListOrgPolicies

ServiceName: cloudresourcemanager.googleapis.com

Description

List organization policies set on a resource (bare ListOrgPolicies log form).

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-q2azs8dfvwe",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "orgpolicy.policy.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "ListOrgPolicies",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v1.ListOrgPoliciesRequest",
      "resource": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.resource-manager.org-policies.list invocation-id/bbd568a223214121ab2d4f2f1179d2ea environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:51.594569042Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:50.822814Z"
}

SetOrgPolicy

ServiceName: cloudresourcemanager.googleapis.com

Description

Set an organization policy on a resource (bare SetOrgPolicy log form).

Example Audit Log Entry #

{
  "insertId": "2a6v4ne5269g",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": false,
        "permission": "orgpolicy.policy.set",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "SetOrgPolicy",
    "request": {
      "@type": "type.googleapis.com/google.cloud.orgpolicy.v1.SetOrgPolicyRequest",
      "policy": {
        "booleanPolicy": {
          "enforced": true
        },
        "constraint": "constraints/compute.disableSerialPortAccess"
      },
      "resource": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.resource-manager.org-policies.enable-enforce invocation-id/59308ce6aaab402ab2015ad52df58ed3 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {}
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudresourcemanager.googleapis.com",
    "status": {
      "code": 7,
      "message": "An unexpected error occurred. Please try again later."
    }
  },
  "receiveTimestamp": "2026-06-29T15:28:56.630434334Z",
  "resource": {
    "labels": {
      "project_id": "example-project-id"
    },
    "type": "project"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T15:28:55.534531Z"
}