detection.wiki

Secret Manager

methodNameDescriptionLog typeSampleRule
anyCatch-all entry for secretmanager.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.activityNN
google.cloud.secretmanager.SecretManagerService.AccessSecretVersionAccesses a SecretVersion. This call returns the secret data.data_accessYY
google.cloud.secretmanager.SecretManagerService.AddSecretVersionCreates a new SecretVersion containing secret data and appends it to an existing Secret.activityYN
google.cloud.secretmanager.SecretManagerService.CreateSecretCreates a new Secret containing no SecretVersions.activityYN
google.cloud.secretmanager.SecretManagerService.DeleteSecretDeletes a Secret.activityYY
google.cloud.secretmanager.SecretManagerService.DestroySecretVersionDestroys a SecretVersion. Sets the state of the SecretVersion to DESTROYED and irrevocably destroys the secret data.activityYY
google.cloud.secretmanager.SecretManagerService.DisableSecretVersionDisables a SecretVersion. Sets the state of the SecretVersion to DISABLED.activityYN
google.cloud.secretmanager.SecretManagerService.EnableSecretVersionEnables a SecretVersion. Sets the state of the SecretVersion to ENABLED.activityYN
google.cloud.secretmanager.SecretManagerService.GetIamPolicydata_accessNN
google.cloud.secretmanager.SecretManagerService.GetSecretdata_accessYN
google.cloud.secretmanager.SecretManagerService.GetSecretVersiondata_accessNN
google.cloud.secretmanager.SecretManagerService.ListSecretVersionsdata_accessYN
google.cloud.secretmanager.SecretManagerService.ListSecretsdata_accessYN
google.cloud.secretmanager.SecretManagerService.SetIamPolicySets the access control policy on the specified secret. Replaces any existing policy.activityYN
google.cloud.secretmanager.SecretManagerService.TestIamPermissionsdata_accessNN
google.cloud.secretmanager.SecretManagerService.UpdateSecretUpdates metadata of an existing Secret.activityYN
google.cloud.secretmanager.SecretManagerService.EnableManagedRotationactivityNN
google.cloud.secretmanager.SecretManagerService.RotateSecretactivityNN

any: secretmanager.googleapis.com (any method)

#
ServiceName
secretmanager.googleapis.com

Description

Catch-all entry for secretmanager.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

google.cloud.secretmanager.SecretManagerService.AccessSecretVersion: Access secret version

#
ServiceName
secretmanager.googleapis.com

Description

Accesses a SecretVersion. This call returns the secret data.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1wjd2c0e4f6cd",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.access",
        "permissionType": "DATA_READ",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwgen-dw739065/versions/latest",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/SecretVersion"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.AccessSecretVersionRequest",
      "name": "projects/example-project-id/secrets/dwgen-dw739065/versions/latest"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.versions.access invocation-id/6e1614f2206d4be5b7f9251b573f71ce environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:53.881909539Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwgen-dw739065/versions/latest",
    "serviceName": "secretmanager.googleapis.com",
    "status": {
      "code": 5,
      "message": "Secret [projects/000000000000/secrets/dwgen-dw739065] not found or has no versions."
    }
  },
  "receiveTimestamp": "2026-06-29T13:19:54.284755649Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.AccessSecretVersion",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "ERROR",
  "timestamp": "2026-06-29T13:19:53.870966830Z"
}

Common Indicators #

Field/value combinations most frequently checked by detection rules targeting this event, derived from cross-vendor predicate analysis.

FieldKindValueRulesVendors
EventType (elastic rule field)eqgetsecretvalue1 ruleelastic
EventType (elastic rule field)inkeyget1 ruleelastic
EventType (elastic rule field)insecretget1 ruleelastic
kubernetes.audit.objectRef.resource (elastic rule field)eqsecrets1 ruleelastic

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Elastic #

  • Multiple Cloud Secrets Accessed by Source Address source high: This rule detects authenticated sessions accessing secret stores across multiple environments from the same source address within a short period of time, including cloud providers (AWS, GCP, Azure) and Kubernetes clusters. Adversaries with access to compromised credentials or session tokens may attempt to retrieve secrets from services such as AWS Secrets Manager, Google Secret Manager, Azure Key Vault, or Kubernetes Secrets in rapid succession to expand their access or exfiltrate sensitive information.T1555, T1555.006

google.cloud.secretmanager.SecretManagerService.AddSecretVersion: Add secret version

#
ServiceName
secretmanager.googleapis.com

Description

Creates a new SecretVersion containing secret data and appends it to an existing Secret.

Example Audit Log Entry #

{
  "insertId": "1wjd2c0e4f8if",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.add",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwgen-dw739065/versions/NEW",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/SecretVersion"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.AddSecretVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.AddSecretVersionRequest",
      "parent": "projects/example-project-id/secrets/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.versions.add invocation-id/3282359932fa45d4a730a65f1f8716e3 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/False python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:22:13.867087346Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwgen-dw739065/versions/1",
    "response": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.SecretVersion",
      "createTime": "2026-06-29T13:22:14.394039Z",
      "name": "projects/000000000000/secrets/dwgen-dw739065/versions/1",
      "state": "ENABLED"
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:22:15.310222940Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.AddSecretVersion",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:22:13.810246773Z"
}

google.cloud.secretmanager.SecretManagerService.CreateSecret: Create secret

#
ServiceName
secretmanager.googleapis.com

Description

Creates a new Secret containing no SecretVersions.

Example Audit Log Entry #

{
  "insertId": "1wjd2c0e4f6br",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.create",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwgen-dw739065",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.CreateSecret",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.CreateSecretRequest",
      "parent": "projects/example-project-id",
      "secret": {
        "replication": {
          "automatic": {}
        }
      },
      "secretId": "dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.create invocation-id/3911221e92c949b88eac20ba3c3f3621 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:51.860126746Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwgen-dw739065",
    "response": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.Secret",
      "createTime": "2026-06-29T13:19:51.885323Z",
      "name": "projects/000000000000/secrets/dwgen-dw739065",
      "replication": {
        "automatic": {}
      }
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:52.152188368Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.CreateSecret",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T13:19:51.850553948Z"
}

google.cloud.secretmanager.SecretManagerService.DeleteSecret: Delete secret

#
ServiceName
secretmanager.googleapis.com

Description

Deletes a Secret.

Example Audit Log Entry #

{
  "insertId": "1ifia5de49246",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.delete",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec7201353",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.DeleteSecret",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.DeleteSecretRequest",
      "name": "projects/example-project-id/secrets/dwsec7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.delete invocation-id/bf310e069b4f4305956ccdf23d10bcf8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:43.714799361Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec7201353",
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:44.908114798Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.DeleteSecret",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T16:25:43.517470775Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.cloud.secretmanager.SecretManagerService.DestroySecretVersion: Destroy secret version

#
ServiceName
secretmanager.googleapis.com

Description

Destroys a SecretVersion. Sets the state of the SecretVersion to DESTROYED and irrevocably destroys the secret data.

Example Audit Log Entry #

{
  "insertId": "1lgboq3e4iebk",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.destroy",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/SecretVersion"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.DestroySecretVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.DestroySecretVersionRequest",
      "name": "projects/example-project-id/secrets/dwsec-dw743447/versions/1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.versions.destroy invocation-id/cc18b133b2ed4fe9b8f787541709ff99 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:39.381316590Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:40.122676113Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.DestroySecretVersion",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:39.328590337Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

YARA-L #

google.cloud.secretmanager.SecretManagerService.DisableSecretVersion: Disable secret version

#
ServiceName
secretmanager.googleapis.com

Description

Disables a SecretVersion. Sets the state of the SecretVersion to DISABLED.

Example Audit Log Entry #

{
  "insertId": "dbsoa7e2jxpt",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.disable",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/SecretVersion"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.DisableSecretVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.DisableSecretVersionRequest",
      "name": "projects/example-project-id/secrets/dwsec-dw743447/versions/1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.versions.disable invocation-id/f334ae9295084a72ba32ab8227276ad0 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:37.067255365Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
    "response": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.SecretVersion",
      "createTime": "2026-06-29T14:33:33.209210Z",
      "name": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
      "state": "DISABLED"
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:37.730980724Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.DisableSecretVersion",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:37.012311685Z"
}

google.cloud.secretmanager.SecretManagerService.EnableSecretVersion: Enable secret version

#
ServiceName
secretmanager.googleapis.com

Description

Enables a SecretVersion. Sets the state of the SecretVersion to ENABLED.

Example Audit Log Entry #

{
  "insertId": "1lgboq3e4ieb0",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.enable",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/SecretVersion"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.EnableSecretVersion",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.EnableSecretVersionRequest",
      "name": "projects/example-project-id/secrets/dwsec-dw743447/versions/1"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.versions.enable invocation-id/c8dbd6abc41e4e17bcdc473f5cc18e8b environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:38.325678736Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
    "response": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.SecretVersion",
      "createTime": "2026-06-29T14:33:33.209210Z",
      "name": "projects/000000000000/secrets/dwsec-dw743447/versions/1",
      "state": "ENABLED"
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:39.123985670Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.EnableSecretVersion",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:38.270810827Z"
}

google.cloud.secretmanager.SecretManagerService.GetIamPolicy: GetIamPolicy

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.secretmanager.SecretManagerService.GetSecret: GetSecret

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "1ifia5de44bo1",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.get",
        "permissionType": "ADMIN_READ",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwgen-dw739065",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.GetSecret",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.GetSecretRequest",
      "name": "projects/example-project-id/secrets/dwgen-dw739065"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.describe invocation-id/cad8456d6e8a491b8cb0b62e3b902966 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:19:54.857623544Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwgen-dw739065",
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:19:55.571565094Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.GetSecret",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:19:54.800077462Z"
}

google.cloud.secretmanager.SecretManagerService.GetSecretVersion: GetSecretVersion

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.secretmanager.SecretManagerService.ListSecretVersions: ListSecretVersions

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "dbsoa7e2mw79",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.versions.list",
        "permissionType": "ADMIN_READ",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec7201353",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.ListSecretVersions",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.ListSecretVersionsRequest",
      "parent": "projects/example-project-id/secrets/dwsec7201353"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.delete invocation-id/bf310e069b4f4305956ccdf23d10bcf8 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T16:25:43.293420576Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec7201353",
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T16:25:44.014206836Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.ListSecretVersions",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T16:25:43.236656977Z"
}

google.cloud.secretmanager.SecretManagerService.ListSecrets: ListSecrets

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "yonynpe3xjdi",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.list",
        "permissionType": "ADMIN_READ",
        "resourceAttributes": {
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.ListSecrets",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.ListSecretsRequest",
      "parent": "projects/example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.list invocation-id/a3d60b81875044ed94ce5cec6f9a2335 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:17:55.613520645Z"
      }
    },
    "resourceName": "projects/000000000000",
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T13:17:56.080389328Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.ListSecrets",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:17:55.602380976Z"
}

google.cloud.secretmanager.SecretManagerService.SetIamPolicy: Set IAM policy on secret

#
ServiceName
secretmanager.googleapis.com

Description

Sets the access control policy on the specified secret. Replaces any existing policy.

Example Audit Log Entry #

{
  "insertId": "fa10lee2jqpg",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.setIamPolicy",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.SetIamPolicy",
    "request": {
      "@type": "type.googleapis.com/google.iam.v1.SetIamPolicyRequest",
      "policy": {},
      "resource": "projects/example-project-id/secrets/dwsec-dw743447",
      "updateMask": "bindings"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.set-iam-policy invocation-id/d41b1f151bf64613b7024b8bcc874322 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:40.627139876Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.iam.v1.Policy",
      "etag": "BwZVZVg7PV4="
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:41.136997057Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.SetIamPolicy",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:40.357351469Z"
}

google.cloud.secretmanager.SecretManagerService.TestIamPermissions: TestIamPermissions

#
ServiceName
secretmanager.googleapis.com

Data Access audit logs are disabled by default.

google.cloud.secretmanager.SecretManagerService.UpdateSecret: Update secret

#
ServiceName
secretmanager.googleapis.com

Description

Updates metadata of an existing Secret.

Example Audit Log Entry #

{
  "insertId": "ue4ghe4j08e",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "secretmanager.secrets.update",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      },
      {
        "granted": true,
        "permission": "secretmanager.secrets.update",
        "permissionType": "ADMIN_WRITE",
        "resourceAttributes": {
          "name": "projects/000000000000/secrets/dwsec-dw743447",
          "service": "secretmanager.googleapis.com",
          "type": "secretmanager.googleapis.com/Secret"
        }
      }
    ],
    "methodName": "google.cloud.secretmanager.v1.SecretManagerService.UpdateSecret",
    "request": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.UpdateSecretRequest",
      "secret": {
        "name": "projects/example-project-id/secrets/dwsec-dw743447"
      },
      "updateMask": "labels"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "callerSuppliedUserAgent": "google-cloud-sdk gcloud/574.0.0 agent-name/claude_code command/gcloud.secrets.update invocation-id/bde530cadc2841c493d6e52a9ea1ec25 environment/None environment-version/None client-os/LINUX client-os-ver/6.1.0 client-pltf-arch/x86_64 interactive/False from-script/True python/3.14.5 term/tmux-256color  (Linux 6.1.0-41-amd64),gzip(gfe)",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:33:35.829071084Z"
      }
    },
    "resourceName": "projects/000000000000/secrets/dwsec-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.cloud.secretmanager.v1.Secret",
      "createTime": "2026-06-29T14:33:31.240602Z",
      "name": "projects/000000000000/secrets/dwsec-dw743447",
      "replication": {
        "automatic": {}
      }
    },
    "serviceName": "secretmanager.googleapis.com",
    "status": {}
  },
  "receiveTimestamp": "2026-06-29T14:33:36.286325448Z",
  "resource": {
    "labels": {
      "method": "google.cloud.secretmanager.v1.SecretManagerService.UpdateSecret",
      "project_id": "example-project-id",
      "service": "secretmanager.googleapis.com"
    },
    "type": "audited_resource"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:33:35.772075349Z"
}

google.cloud.secretmanager.SecretManagerService.EnableManagedRotation: EnableManagedRotation

#
ServiceName
secretmanager.googleapis.com

google.cloud.secretmanager.SecretManagerService.RotateSecret: RotateSecret

#
ServiceName
secretmanager.googleapis.com