Cloud SQL Admin API

methodName	Description	Log type	Sample	Rule
any	Catch-all entry for sqladmin.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.	activity	N	N
cloudsql.instances.create	Creates a new Cloud SQL instance.	activity	Y	Y
cloudsql.instances.delete	Deletes a Cloud SQL instance.	activity	Y	Y
cloudsql.users.delete	Deletes a user from a Cloud SQL instance.	data_access	Y	Y
cloudsql.users.update	Updates an existing resource containing information about a database user in a Cloud SQL instance.	data_access	Y	Y
cloudsql.instances.get	Read a Cloud SQL instance configuration.	data_access	Y	N
cloudsql.instances.list	List Cloud SQL instances.	data_access	Y	N
cloudsql.instances.update	Update a Cloud SQL instance configuration.	activity	Y	Y
cloudsql.operations.get	Read a Cloud SQL operation.	data_access	Y	N
cloudsql.users.create	Create a Cloud SQL database user.	data_access	Y	N

any: sqladmin.googleapis.com (any method)

ServiceName: sqladmin.googleapis.com

Description

Catch-all entry for sqladmin.googleapis.com. Source-only rules that attribute to the service without a specific method attribute here. Not a distinct audit log operation.

cloudsql.instances.create: Create instance

ServiceName: sqladmin.googleapis.com

Description

Creates a new Cloud SQL instance.

Example Audit Log Entry #

{
  "insertId": "-s0gigrekikk8",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "id": "5776d1ae-8789-4954-b74f-cac500000032",
    "last": true,
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.create",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id/instances/dwsql-dw743447",
          "service": "sqladmin.googleapis.com",
          "type": "sqladmin.googleapis.com/Instance"
        }
      }
    ],
    "methodName": "cloudsql.instances.create",
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:31:11.831957Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:40:17.857896464Z",
  "resource": {
    "labels": {
      "database_id": "",
      "project_id": "example-project-id",
      "region": ""
    },
    "type": "cloudsql_database"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:40:17.714516Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Cloud SQL Database Modified or Deleted source medium: Detect when a Cloud SQL DB has been modified or deleted.↳ also matches cloudsql.instances.delete: Delete instance, cloudsql.users.delete: Delete database user, cloudsql.users.update: Update database user

cloudsql.instances.delete: Delete instance

ServiceName: sqladmin.googleapis.com

Description

Deletes a Cloud SQL instance.

Example Audit Log Entry #

{
  "insertId": "-gcdopgezqnpw",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "first": true,
    "id": "3881e6fe-be5e-42fd-a8dd-8e6400000032",
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.delete",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/instances/dwsql-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/instances/dwsql-dw743447",
          "service": "sqladmin.googleapis.com",
          "type": "sqladmin.googleapis.com/Instance"
        }
      }
    ],
    "methodName": "cloudsql.instances.delete",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlInstancesDeleteRequest",
      "instance": "dwsql-dw743447",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:51:34.246054Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.Operation",
      "insertTime": "2026-06-29T14:51:34.221Z",
      "instanceUid": "1-32b06087-9a81-4cfc-ad10-d719d7752977",
      "kind": "sql#operation",
      "name": "3881e6fe-be5e-42fd-a8dd-8e6400000032",
      "operationType": "DELETE",
      "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/example-project-id/operations/3881e6fe-be5e-42fd-a8dd-8e6400000032",
      "status": "PENDING",
      "targetId": "dwsql-dw743447",
      "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/example-project-id/instances/dwsql-dw743447",
      "targetProject": "example-project-id",
      "user": "user@example.com"
    },
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:51:35.230563182Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:51:34.190590Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Cloud SQL Database Modified or Deleted source medium: Detect when a Cloud SQL DB has been modified or deleted.↳ also matches cloudsql.instances.create: Create instance, cloudsql.users.delete: Delete database user, cloudsql.users.update: Update database user

cloudsql.users.delete: Delete database user

ServiceName: sqladmin.googleapis.com

Description

Deletes a user from a Cloud SQL instance.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-q2fstletfw6b",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "operation": {
    "first": true,
    "id": "689856ab-151d-40f0-9fd1-839300000032",
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.users.delete",
        "permissionType": "DATA_WRITE",
        "resource": "projects/example-project-id/instances/dwsql-dw743447/users/dwuser",
        "resourceAttributes": {
          "service": "sqladmin.googleapis.com"
        }
      }
    ],
    "methodName": "cloudsql.users.delete",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlUsersDeleteRequest",
      "instance": "dwsql-dw743447",
      "name": "dwuser",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:40:36.621761Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447/users/dwuser",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:40:37.386052233Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:40:36.471856Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Cloud SQL Database Modified or Deleted source medium: Detect when a Cloud SQL DB has been modified or deleted.↳ also matches cloudsql.instances.create: Create instance, cloudsql.instances.delete: Delete instance, cloudsql.users.update: Update database user

cloudsql.users.update: Update database user

ServiceName: sqladmin.googleapis.com

Description

Updates an existing resource containing information about a database user in a Cloud SQL instance.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "x2e9miejumyy",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "operation": {
    "first": true,
    "id": "6ea809d6-c714-4db6-8991-5a2c00000032",
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.users.update",
        "permissionType": "DATA_WRITE",
        "resource": "projects/example-project-id/instances/dwsql-dw743447/users/dwuser",
        "resourceAttributes": {
          "service": "sqladmin.googleapis.com"
        }
      }
    ],
    "methodName": "cloudsql.users.update",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlUsersUpdateRequest",
      "body": {
        "instance": "dwsql-dw743447",
        "name": "dwuser",
        "project": "example-project-id"
      },
      "instance": "dwsql-dw743447",
      "name": "dwuser",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:40:34.266938Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447/users/dwuser",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:40:34.511536344Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:40:34.134561Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Sigma #

Google Cloud SQL Database Modified or Deleted source medium: Detect when a Cloud SQL DB has been modified or deleted.↳ also matches cloudsql.instances.create: Create instance, cloudsql.instances.delete: Delete instance, cloudsql.users.delete: Delete database user

cloudsql.instances.get

ServiceName: sqladmin.googleapis.com

Description

Read a Cloud SQL instance configuration.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-hphnjgf13fnnk",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/instances/dwsql-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/instances/dwsql-dw743447",
          "service": "sqladmin.googleapis.com",
          "type": "sqladmin.googleapis.com/Instance"
        }
      }
    ],
    "methodName": "cloudsql.instances.get",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlInstancesGetRequest",
      "instance": "dwsql-dw743447",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:51:33.977306Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:51:34.022037372Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:51:33.944Z"
}

cloudsql.instances.list

ServiceName: sqladmin.googleapis.com

Description

List Cloud SQL instances.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-czj87eez9hx9",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.list",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id",
        "resourceAttributes": {
          "name": "projects/example-project-id",
          "service": "cloudresourcemanager.googleapis.com",
          "type": "cloudresourcemanager.googleapis.com/Project"
        }
      }
    ],
    "methodName": "cloudsql.instances.list",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlInstancesListRequest",
      "maxResults": 1000,
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T13:18:11.210269Z"
      }
    },
    "resourceName": "projects/example-project-id",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T13:18:11.432064574Z",
  "resource": {
    "labels": {
      "database_id": "",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T13:18:11.199438Z"
}

cloudsql.instances.update

ServiceName: sqladmin.googleapis.com

Description

Update a Cloud SQL instance configuration.

Example Audit Log Entry #

{
  "insertId": "-yxcw5neisf97",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Factivity",
  "operation": {
    "first": true,
    "id": "ce2815f2-e2ed-4bc2-bccd-af4a00000032",
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.update",
        "permissionType": "ADMIN_WRITE",
        "resource": "projects/example-project-id/instances/dwsql-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/instances/dwsql-dw743447",
          "service": "sqladmin.googleapis.com",
          "type": "sqladmin.googleapis.com/Instance"
        }
      }
    ],
    "methodName": "cloudsql.instances.update",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlInstancesPatchRequest",
      "body": {
        "kind": "sql#instance",
        "name": "dwsql-dw743447",
        "project": "example-project-id",
        "settings": {
          "activationPolicy": "NEVER",
          "kind": "sql#settings"
        }
      },
      "instance": "dwsql-dw743447",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:40:39.284624Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447",
    "response": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.Operation",
      "insertTime": "2026-06-29T14:40:39.253Z",
      "instanceUid": "1-32b06087-9a81-4cfc-ad10-d719d7752977",
      "kind": "sql#operation",
      "name": "ce2815f2-e2ed-4bc2-bccd-af4a00000032",
      "operationType": "UPDATE",
      "selfLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/example-project-id/operations/ce2815f2-e2ed-4bc2-bccd-af4a00000032",
      "status": "PENDING",
      "targetId": "dwsql-dw743447",
      "targetLink": "https://sqladmin.googleapis.com/sql/v1beta4/projects/example-project-id/instances/dwsql-dw743447",
      "targetProject": "example-project-id",
      "user": "user@example.com"
    },
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:40:39.503879125Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "NOTICE",
  "timestamp": "2026-06-29T14:40:39.173842Z"
}

Detection Rules #

Full rule details for this event, including ATT&CK technique mappings and native queries →

Panther #

GCP SQL Config Changes source low: Monitoring changes to Sql Instance configuration may reduce time to detect and correct misconfigurations done on sql server.

cloudsql.operations.get

ServiceName: sqladmin.googleapis.com

Description

Read a Cloud SQL operation.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-qw24l6f14t77z",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.instances.get",
        "permissionType": "ADMIN_READ",
        "resource": "projects/example-project-id/instances/dwsql-dw743447",
        "resourceAttributes": {
          "name": "projects/example-project-id/instances/dwsql-dw743447",
          "service": "sqladmin.googleapis.com",
          "type": "sqladmin.googleapis.com/Instance"
        }
      }
    ],
    "methodName": "cloudsql.operations.get",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlOperationsGetRequest",
      "operation": "3881e6fe-be5e-42fd-a8dd-8e6400000032",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:53:29.574807Z"
      }
    },
    "resourceName": "projects/example-project-id/operations/3881e6fe-be5e-42fd-a8dd-8e6400000032",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:53:29.854630843Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:53:29.553976Z"
}

cloudsql.users.create

ServiceName: sqladmin.googleapis.com

Description

Create a Cloud SQL database user.

Data Access audit logs are disabled by default.

Example Audit Log Entry #

{
  "insertId": "-zhpjjwejsbn7",
  "logName": "projects/example-project-id/logs/cloudaudit.googleapis.com%2Fdata_access",
  "operation": {
    "first": true,
    "id": "0c410ac7-9b05-4a2f-8645-ed0b00000032",
    "producer": "cloudsql.googleapis.com"
  },
  "protoPayload": {
    "@type": "type.googleapis.com/google.cloud.audit.AuditLog",
    "authenticationInfo": {
      "oauthInfo": {
        "oauthClientId": "32555940559.apps.googleusercontent.com"
      },
      "principalEmail": "user@example.com",
      "principalSubject": "user:user@example.com"
    },
    "authorizationInfo": [
      {
        "granted": true,
        "permission": "cloudsql.users.create",
        "permissionType": "DATA_WRITE",
        "resource": "projects/example-project-id/instances/dwsql-dw743447",
        "resourceAttributes": {
          "service": "sqladmin.googleapis.com"
        }
      }
    ],
    "methodName": "cloudsql.users.create",
    "request": {
      "@type": "type.googleapis.com/google.cloud.sql.v1beta4.SqlUsersInsertRequest",
      "body": {
        "instance": "dwsql-dw743447",
        "kind": "sql#user",
        "name": "dwuser",
        "project": "example-project-id"
      },
      "instance": "dwsql-dw743447",
      "project": "example-project-id"
    },
    "requestMetadata": {
      "callerIp": "203.0.113.10",
      "destinationAttributes": {},
      "requestAttributes": {
        "auth": {},
        "time": "2026-06-29T14:40:31.869264Z"
      }
    },
    "resourceName": "projects/example-project-id/instances/dwsql-dw743447",
    "serviceName": "cloudsql.googleapis.com",
    "status": {
      "message": "OK"
    }
  },
  "receiveTimestamp": "2026-06-29T14:40:32.407390332Z",
  "resource": {
    "labels": {
      "database_id": "example-project-id:dwsql-dw743447",
      "project_id": "example-project-id",
      "region": "us-central1"
    },
    "type": "cloudsql_database"
  },
  "severity": "INFO",
  "timestamp": "2026-06-29T14:40:31.680903Z"
}