Audit logging

This page describes how audit logging works when securing the Google Cloud console and the Google Cloud APIs with Access Context Manager.

Access Context Manager by default logs all access requests to the Google Cloud console and the Google Cloud APIs that are denied because of security policy violations to Cloud Logging. The audit log records are securely stored in Google infrastructure and available for future analysis. The content of the audit log is available on a per-organization basis in the Google Cloud console. The Access Context Manager audit log is written into the "Audited Resource" logging stream and is available in Cloud Logging.

Audit log record content

Each audit log record contains information which can be divided into two major categories: the information about the original call, and information about security policy violations. It is filled as follows:

Audit Log Field Meaning
logName The organization identification and audit log type.
serviceName The name of the service handling the call, contextawareaccess.googleapis.com, that resulted in the creation of this audit record.
authenticationInfo.principal_email Email address of the user issuing the original call.
timestamp The time of the targeted operation.
resource The target of the audited operation.
resourceName The organization intended to receive this audit record.
requestMetadata.callerIp The IP address from which the call originated.
requestMetadata.requestAttributes.auth.accessLevels The access levels in the organization that the request satisfied, regardless of whether those access levels are applied in the access binding.
status The overall status of handling an operation described in this record.
metadata

An instance of the google.cloud.audit.ContextAwareAccessAuditMetadata protobuf type, serialized as a JSON Struct. It includes the following fields:

  • appliedAccessLevels: The access levels required by the active access policy in the binding.
  • appliedDryRunAccessLevels: The access levels required by the dry-run access policy in the binding.
  • unsatisfiedAccessLevels: The access levels in the organization that the request failed to satisfy. This list can include access levels that aren't applied in the access binding. To identify which access levels caused an access denial, compare this field with appliedAccessLevels or appliedDryRunAccessLevels.
  • evaluationResult: The evaluation result of the active access policy (GRANTED or DENIED). If no active access levels are applied in the binding, this field is set to GRANTED.
  • dryRunEvaluationResult: The evaluation result of the dry-run access policy (GRANTED or DENIED). If no dry-run access levels are applied in the binding, this field is set to GRANTED, even when evaluationResult is DENIED.
  • deniedApplications: The applications for which access was denied.

Accessing the audit log

The content of the audit log is available on a per-organization basis in the Google Cloud console. The Access Context Manager audit log is written into the "Audited Resource" logging stream and is available in Cloud Logging.

What's next