GCP Cloud Audit Log

Search the GCP rules.

Service providers

ServiceAudit log typesOperationsSamplesRules
Access Context ManagerAdmin activityAdmin activity1001
API KeysAdmin activity, Data accessAdmin activity, Data access442
App Engine AdminAdmin activity, Data accessAdmin activity, Data access633
BigQueryAdmin activity, Data accessAdmin activity, Data access761
Cloud BuildAdmin activity, Data accessAdmin activity, Data access1921
Cloud Data Loss Prevention (DLP)Data accessData access101
Cloud Deployment ManagerAdmin activity, Data accessAdmin activity, Data access1101
Cloud DNSAdmin activity, Data accessAdmin activity, Data access40114
Cloud Functions (Cloud Run functions)Admin activity, Data accessAdmin activity, Data access1501
Cloud Key Management Service (KMS)Admin activity, Data access, No audit logsAdmin activity, Data access, No audit logs35105
Cloud LoggingAdmin activity, Data accessAdmin activity, Data access17134
Cloud Pub/SubAdmin activity, Data access, No audit logsAdmin activity, Data access, No audit logs28124
Cloud Resource ManagerAdmin activity, Data accessAdmin activity, Data access1472
Cloud RunAdmin activity, Data accessAdmin activity, Data access2382
Cloud SQL Admin APIAdmin activity, Data accessAdmin activity, Data access995
Cloud StorageAdmin activity, Data accessAdmin activity, Data access891713
Compute EngineAdmin activity, Data access, System eventAdmin activity, Data access, System event99916925
Google Kubernetes Engine (GKE)Admin activity, Data accessAdmin activity, Data access1050
Google Workspace Admin AuditAdmin activityAdmin activity202
IAM Service Account CredentialsAdmin activity, Data accessAdmin activity, Data access412
Identity and Access Management (IAM)Admin activity, Data accessAdmin activity, Data access472025
Identity-Aware ProxyAdmin activity, Data accessAdmin activity, Data access1102
Network ManagementAdmin activity, Data accessAdmin activity, Data access951
Organization PolicyAdmin activityAdmin activity323
OS LoginData access, No audit logsData access, No audit logs702
Secret ManagerAdmin activity, Data accessAdmin activity, Data access17123
Security Command CenterAdmin activity, Data accessAdmin activity, Data access6301
Serial Console SSH GatewayAdmin activityAdmin activity201
Service UsageAdmin activityAdmin activity331

References