Cloud Run

any: run.googleapis.com (any method)

#
ServiceName
run.googleapis.com

Description

Catch-all entry for run.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
protoPayload.authorizationInfo (panther rule field)is_not_null1 rulepanther
severity (panther rule field)neERROR1 rulepanther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

  • GCP Cloud Run Set IAM Policy source high: Detects new roles granted to users to Cloud Run Services. This could potentially allow the user to perform actions within the project and its resources, which could pose a security risk.

google.cloud.run.Executions.CancelExecution: CancelExecution

#
ServiceName
run.googleapis.com

google.cloud.run.Executions.DeleteExecution: DeleteExecution

#
ServiceName
run.googleapis.com

google.cloud.run.Executions.GetExecution: GetExecution

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Executions.ListExecutions: ListExecutions

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Jobs.CreateJob: CreateJob

#
ServiceName
run.googleapis.com

Example Audit Log Entry #

{
  "insertId": "u0gsjjdllci",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.jobs.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/jobs/dwjob-dw743447",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.jobs.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/jobs/dwjob-dw743447",
        "resourceAttributes": {
          "name": "namespaces/example-project-id/jobs/dwjob-dw743447",
          "service": "run.googleapis.com/",
          "type": "run.googleapis.com/Job"
        }
      }
    ],
    "methodName": "google.cloud.run.v1.Jobs.CreateJob",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.CreateJobRequest",
      "job": {
        "apiVersion": "run.googleapis.com/v1",
        "kind": "Job",
        "metadata": {
          "annotations": {
            "run.googleapis.com/client-name": "gcloud",
            "run.googleapis.com/client-version": "574.0.0"
          },
          "name": "dwjob-dw743447",
          "namespace": "example-project-id"
        },
        "spec": {
          "template": {
            "metadata": {
              "annotations": {
                "run.googleapis.com/client-name": "gcloud",
                "run.googleapis.com/client-version": "574.0.0"
              },
              "labels": {
                "client.knative.dev/nonce": "zuq_tak_cih"
              }
            },
            "spec": {
              "template": {
                "spec": {
                  "containers": [
                    {
                      "image": "us-docker.pkg.dev/cloudrun/container/hello",
                      "name": ""
                    }
                  ]
                }
              }
            }
          }
        },
        "status": {
          "latestCreatedExecution": {}
        }
      },
      "parent": "namespaces/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.jobs.create invocation-id/f75ace572e4949a8b851b4b77054f62d environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:34:30.574332Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/jobs/dwjob-dw743447",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:34:31.515682244Z",
  "resource": {
    "labels": {
      "job_name": "dwjob-dw743447",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloud_run_job"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:34:30.423486Z"
}

google.cloud.run.Jobs.DeleteJob: DeleteJob

#
ServiceName
run.googleapis.com

Example Audit Log Entry #

{
  "insertId": "1mv78nsdp7ag",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.jobs.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/jobs/dwjob5-dw746783",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.run.v1.Jobs.DeleteJob",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.DeleteJobRequest",
      "name": "namespaces/example-project-id/jobs/dwjob5-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.jobs.delete invocation-id/b637feefc9d24e52b6682698b38ed84f environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:32:04.198527Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/jobs/dwjob5-dw746783",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:32:05.138456571Z",
  "resource": {
    "labels": {
      "job_name": "dwjob5-dw746783",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloud_run_job"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:32:04.135467Z"
}

google.cloud.run.Jobs.GetIamPolicy: GetIamPolicy

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Jobs.GetJob: GetJob

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Jobs.ListJobs: ListJobs

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "13eg8ivd25vd",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.jobs.list",
        "permissionType": "ADMIN_READ",
        "resource": "namespaces/example-project-id/jobs",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.run.v1.Jobs.ListJobs",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.ListJobsRequest",
      "parent": "namespaces/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.jobs.list invocation-id/af29e8ea28364b62bccc76122893b668 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:38:42.460455Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/jobs",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:38:42.728480240Z",
  "resource": {
    "labels": {
      "job_name": "",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloud_run_job"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T15:38:42.400552Z"
}

google.cloud.run.Jobs.RunJob: RunJob

#
ServiceName
run.googleapis.com

google.cloud.run.Jobs.SetIamPolicy: SetIamPolicy

#
ServiceName
run.googleapis.com

google.cloud.run.Jobs.TestIamPermissions: TestIamPermissions

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Jobs.UpdateJob: UpdateJob

#
ServiceName
run.googleapis.com

google.cloud.run.Services.CreateService: CreateService

#
ServiceName
run.googleapis.com

Example Audit Log Entry #

{
  "insertId": "g5jjo1du0mq",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.services.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/services/dwgen-dw739065",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.operations.get",
        "permissionType": "ADMIN_READ",
        "resource": "dwgen-dw739065",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.services.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/services/dwgen-dw739065",
        "resourceAttributes": {
          "name": "namespaces/example-project-id/services/dwgen-dw739065",
          "service": "run.googleapis.com/",
          "type": "run.googleapis.com/Service"
        }
      }
    ],
    "methodName": "google.cloud.run.v1.Services.CreateService",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.CreateServiceRequest",
      "parent": "namespaces/example-project-id",
      "service": {
        "apiVersion": "serving.knative.dev/v1",
        "kind": "Service",
        "metadata": {
          "annotations": {
            "run.googleapis.com/client-name": "gcloud",
            "run.googleapis.com/client-version": "574.0.0"
          },
          "name": "dwgen-dw739065",
          "namespace": "example-project-id"
        },
        "spec": {
          "template": {
            "metadata": {
              "annotations": {
                "run.googleapis.com/client-name": "gcloud",
                "run.googleapis.com/client-version": "574.0.0",
                "run.googleapis.com/startup-cpu-boost": "True"
              },
              "labels": {
                "client.knative.dev/nonce": "tctmcmnpeo"
              }
            },
            "spec": {
              "containers": [
                {
                  "image": "us-docker.pkg.dev/cloudrun/container/hello",
                  "name": ""
                }
              ]
            }
          }
        },
        "status": {}
      }
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.deploy invocation-id/acf5325ef22e41ad815a1eb69d1f5efa environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:21:00.066251Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/services/dwgen-dw739065",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:21:00.817718464Z",
  "resource": {
    "labels": {
      "configuration_name": "",
      "location": "us-central1",
      "project_id": "example-project-id",
      "revision_name": "",
      "service_name": "dwgen-dw739065"
    },
    "type": "cloud_run_revision"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:20:59.824817Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
protoPayload.authorizationInfo (panther rule field)is_not_null1 rulepanther
severity (panther rule field)neERROR1 rulepanther

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

  • GCP Cloud Run Service Created source low: Detects creation of new Cloud Run Service, which, if configured maliciously, may be part of the attack aimed to invoke the service and retrieve the access token.

google.cloud.run.Services.DeleteService: DeleteService

#
ServiceName
run.googleapis.com

google.cloud.run.Services.GetIamPolicy: GetIamPolicy

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Services.GetService: GetService

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "19kewlad4qd4",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.services.get",
        "permissionType": "ADMIN_READ",
        "resource": "namespaces/example-project-id/services/dwgen-dw739065",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.run.v1.Services.GetService",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.GetServiceRequest",
      "name": "namespaces/example-project-id/services/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.deploy invocation-id/acf5325ef22e41ad815a1eb69d1f5efa environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:20:59.537962Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/services/dwgen-dw739065",
    "serviceName": "run.googleapis.com",
    "status": {
      "code": 5,
      "message": "Resource 'dwgen-dw739065' of kind 'SERVICE' in region 'us-central1' in project 'example-project-id' does not exist."
    }
  },
  "receiveTimestamp": "2026-06-29T13:21:00.523554089Z",
  "resource": {
    "labels": {
      "configuration_name": "",
      "location": "us-central1",
      "project_id": "example-project-id",
      "revision_name": "",
      "service_name": "dwgen-dw739065"
    },
    "type": "cloud_run_revision"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T13:20:59.489690Z"
}

google.cloud.run.Services.ListServices: ListServices

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "7iovmmd7151",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.services.list",
        "permissionType": "ADMIN_READ",
        "resource": "namespaces/example-project-id/services",
        "resourceAttributes": {}
      }
    ],
    "methodName": "google.cloud.run.v1.Services.ListServices",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.ListServicesRequest",
      "parent": "namespaces/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.services.list invocation-id/81a30b596ae84c7982f98ce419f66f61 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:18:05.994806Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/services",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:18:06.387121032Z",
  "resource": {
    "labels": {
      "configuration_name": "",
      "location": "us-central1",
      "project_id": "example-project-id",
      "revision_name": "",
      "service_name": ""
    },
    "type": "cloud_run_revision"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:18:05.932465Z"
}

google.cloud.run.Services.SetIamPolicy: SetIamPolicy

#
ServiceName
run.googleapis.com

google.cloud.run.Services.TestIamPermissions: TestIamPermissions

#
ServiceName
run.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.run.Services.UpdateService: UpdateService

#
ServiceName
run.googleapis.com

google.cloud.run.Jobs.ReplaceJob: ReplaceJob

#
ServiceName
run.googleapis.com

Description

Replace (update) a Cloud Run job.

Example Audit Log Entry #

{
  "insertId": "1kct0gcdwh1t",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.jobs.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/jobs/dwjob5-dw746783",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.jobs.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/jobs/dwjob5-dw746783",
        "resourceAttributes": {
          "name": "namespaces/example-project-id/jobs/dwjob5-dw746783",
          "service": "run.googleapis.com/",
          "type": "run.googleapis.com/Job"
        }
      }
    ],
    "methodName": "google.cloud.run.v1.Jobs.ReplaceJob",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.ReplaceJobRequest",
      "job": {
        "apiVersion": "run.googleapis.com/v1",
        "kind": "Job",
        "metadata": {
          "annotations": {
            "run.googleapis.com/client-name": "gcloud",
            "run.googleapis.com/client-version": "574.0.0",
            "run.googleapis.com/creator": "user@example.com",
            "run.googleapis.com/lastModifier": "user@example.com",
            "run.googleapis.com/operation-id": "aa3949b6-d374-45ab-8361-b789dc4a0595"
          },
          "creationTimestamp": "2026-06-29T15:27:28.466490Z",
          "generation": 1,
          "labels": {
            "cloud.googleapis.com/location": "us-central1",
            "run.googleapis.com/lastUpdatedTime": "2026-06-29T15:27:28.466490Z"
          },
          "name": "dwjob5-dw746783",
          "namespace": "000000000000",
          "resourceVersion": "AAZVZh1yNEA",
          "selfLink": "/apis/run.googleapis.com/v1/namespaces/000000000000/jobs/dwjob5-dw746783",
          "uid": "8b2e27c0-35c7-43f6-a71f-070d684fbb61"
        },
        "spec": {
          "template": {
            "metadata": {
              "annotations": {
                "run.googleapis.com/client-name": "gcloud",
                "run.googleapis.com/client-version": "574.0.0",
                "run.googleapis.com/execution-environment": "gen2"
              },
              "labels": {
                "client.knative.dev/nonce": "niy_nul_lac"
              }
            },
            "spec": {
              "taskCount": 1,
              "template": {
                "spec": {
                  "containers": [
                    {
                      "image": "us-docker.pkg.dev/cloudrun/container/hello",
                      "resources": {
                        "limits": {
                          "cpu": "1000m",
                          "memory": "512Mi"
                        }
                      }
                    }
                  ],
                  "maxRetries": 3,
                  "serviceAccountName": "000000000000-compute@developer.gserviceaccount.com",
                  "timeoutSeconds": "600"
                }
              }
            }
          }
        },
        "status": {
          "conditions": [
            {
              "lastTransitionTime": "2026-06-29T15:27:28.899607Z",
              "status": "True",
              "type": "Ready"
            }
          ],
          "executionCount": 1,
          "latestCreatedExecution": {
            "completionStatus": "EXECUTION_RUNNING",
            "creationTimestamp": "2026-06-29T15:27:32.108262Z",
            "name": "dwjob5-dw746783-l4mxb"
          },
          "observedGeneration": 1
        }
      },
      "name": "namespaces/example-project-id/jobs/dwjob5-dw746783"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.jobs.update invocation-id/ed2d955d32714ba695afd7488d12fe89 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T15:28:52.442467Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/jobs/dwjob5-dw746783",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T15:28:52.464332013Z",
  "resource": {
    "labels": {
      "job_name": "dwjob5-dw746783",
      "location": "us-central1",
      "project_id": "example-project-id"
    },
    "type": "cloud_run_job"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T15:28:52.303501Z"
}

google.cloud.run.Services.ReplaceService: ReplaceService

#
ServiceName
run.googleapis.com

Description

Replace (update) a Cloud Run service.

Example Audit Log Entry #

{
  "insertId": "tr0bmwduauq",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "run.services.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/services/dwsvc-dw743447",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.operations.get",
        "permissionType": "ADMIN_READ",
        "resource": "dwsvc-dw743447",
        "resourceAttributes": {}
      },
      {
        "granted": true,
        "permission": "run.services.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "namespaces/example-project-id/services/dwsvc-dw743447",
        "resourceAttributes": {
          "name": "namespaces/example-project-id/services/dwsvc-dw743447",
          "service": "run.googleapis.com/",
          "type": "run.googleapis.com/Service"
        }
      }
    ],
    "methodName": "google.cloud.run.v1.Services.ReplaceService",
    "request": {
      "@type": "type.googleapis.com/google.cloud.run.v1.ReplaceServiceRequest",
      "name": "namespaces/example-project-id/services/dwsvc-dw743447",
      "service": {
        "apiVersion": "serving.knative.dev/v1",
        "kind": "Service",
        "metadata": {
          "annotations": {
            "run.googleapis.com/client-name": "gcloud",
            "run.googleapis.com/client-version": "574.0.0",
            "run.googleapis.com/ingress": "all",
            "run.googleapis.com/ingress-status": "all",
            "run.googleapis.com/maxScale": "3",
            "run.googleapis.com/operation-id": "cc698e0a-d804-4bbe-8104-1ad858c0f86c",
            "run.googleapis.com/urls": [
              "https://dwsvc-dw743447-000000000000.us-central1.run.app",
              "https://dwsvc-dw743447-xb5a5sj3kq-uc.a.run.app"
            ],
            "serving.knative.dev/creator": "user@example.com",
            "serving.knative.dev/lastModifier": "user@example.com"
          },
          "creationTimestamp": "2026-06-29T14:34:16.034687Z",
          "generation": 1,
          "labels": {
            "cloud.googleapis.com/location": "us-central1"
          },
          "name": "dwsvc-dw743447",
          "namespace": "000000000000",
          "resourceVersion": "AAZVZVqeDsg",
          "selfLink": "/apis/serving.knative.dev/v1/namespaces/000000000000/services/dwsvc-dw743447",
          "uid": "b9e8e21b-5cbb-450f-a70e-0d0f3e27be07"
        },
        "spec": {
          "template": {
            "metadata": {
              "annotations": {
                "run.googleapis.com/client-name": "gcloud",
                "run.googleapis.com/client-version": "574.0.0",
                "run.googleapis.com/startup-cpu-boost": "true"
              },
              "labels": {
                "client.knative.dev/nonce": "ibgpyldymq",
                "run.googleapis.com/startupProbeType": "Default"
              }
            },
            "spec": {
              "containerConcurrency": 80,
              "containers": [
                {
                  "image": "us-docker.pkg.dev/cloudrun/container/hello",
                  "resources": {
                    "limits": {
                      "cpu": "1000m",
                      "memory": "256Mi"
                    }
                  }
                }
              ],
              "serviceAccountName": "000000000000-compute@developer.gserviceaccount.com",
              "timeoutSeconds": 300
            }
          },
          "traffic": [
            {
              "latestRevision": true,
              "percent": 100
            }
          ]
        },
        "status": {
          "conditions": [
            {
              "lastTransitionTime": "2026-06-29T14:34:20.629704Z",
              "status": "True",
              "type": "Ready"
            },
            {
              "lastTransitionTime": "2026-06-29T14:34:16.967704Z",
              "status": "True",
              "type": "ConfigurationsReady"
            },
            {
              "lastTransitionTime": "2026-06-29T14:34:20.572839Z",
              "status": "True",
              "type": "RoutesReady"
            }
          ],
          "latestCreatedRevisionName": "dwsvc-dw743447-00001-tk8",
          "latestReadyRevisionName": "dwsvc-dw743447-00001-tk8",
          "observedGeneration": 1,
          "traffic": [
            {
              "latestRevision": true,
              "percent": 100,
              "revisionName": "dwsvc-dw743447-00001-tk8"
            }
          ],
          "url": "https://dwsvc-dw743447-xb5a5sj3kq-uc.a.run.app"
        }
      }
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.run.services.update invocation-id/f75c7af3546940f0b4eeccfcbdcbba83 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:34:23.985872Z"
      }
    },
    "resourceLocation": {
      "currentLocations": [
        "us-central1"
      ]
    },
    "resourceName": "namespaces/example-project-id/services/dwsvc-dw743447",
    "serviceName": "run.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:34:24.352039100Z",
  "resource": {
    "labels": {
      "configuration_name": "",
      "location": "us-central1",
      "project_id": "example-project-id",
      "revision_name": "",
      "service_name": "dwsvc-dw743447"
    },
    "type": "cloud_run_revision"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:34:23.812812Z"
}