GKE Identity Service (GIS)

GKE Identity Service (GIS) audit logs in Google Distributed Cloud (GDC) air-gapped let you track authentication activity and token requests in root and organization workloads. These logs record the user identity, issuer, target resource, and JSON payload fields for creating or revoking login tokens and creating Security Token Service (STS) tokens.

Workload location

Root and organization workloads
Audit log source

GKE Identity Service
Audited operations

Revoke or create a login token

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity payload.user

For example,

"payload":{
  "user":"fop-infrastructure-operator@example.com"
}

Target

(Fields and values that call the API)

 resource "resource":"login_token"

Action

(Fields containing the performed operation)

 operation "operation":"revoke"
Event timestamp metadata.timestamp

For example,

"metadata":{
  "timestamp":"2023-01-13T20:04:30.529916149+00:00"
}
Source of action payload.issuer

For example,

"payload":{
  "issuer":"fake-oidc-provider"
}
Outcome description "description":"Revoked Login Token '84518e03-396a-425d-93ac-5ff1e1c993f8' which was previously issued to user 'fop-infrastructure-operator@example.com' due to a web logout"
Other fields Not applicable Not applicable

Example log

{
  "description":"Revoked Login Token '84518e03-396a-425d-93ac-5ff1e1c993f8' which was previously issued to user 'fop-infrastructure-operator@example.com' due to a web logout",
  "id":"55f2ae33-d229-4057-aa1f-d62349281e9c",
  "_gdch_service_tenant":"platform-obs",
  "resource":"login_token",
  "_gdch_tenant_id":"platform-obs",
  "payload":{
    "id":"84518e03-396a-425d-93ac-5ff1e1c993f8",
    "expirationTime":"2023-01-14T08:03:33.413710266+00:00",
    "user":"fop-infrastructure-operator@example.com",
    "groups":[""],
    "issuer":"fake-oidc-provider"
    },
  "_gdch_service_name":"ais",
  "_gdch_namespace":"anthos-identity-service",
  "operation":"revoke",
  "metadata":{
    "userAgent":"",
    "timestamp":"2023-01-13T20:04:30.529916149+00:00"
    },
  "_gdch_org_name":"UNKNOWN",
  "_gdch_org_id":"UNKNOWN",
  "_gdch_cluster":"org-1-admin",
  "_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-nhbwb"
}

Create an STS token

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity identity

For example,

"identity":"fop-shengjiang"

Target

(Fields and values that call the API)

 resource "resource":"AIS STS token"

Action

(Fields containing the performed operation)

 action "action":"Create"
Event timestamp time

For example,

"time":"2022-11-22T18:31:37.084205362+00:00"
Source of action userAgent

For example,

"userAgent":"Go-http-client/2.0"
Outcome response

For example,

"response":"Success"
Other fields Not applicable Not applicable

Example log

{
  "action":"Create",
  "auditID":"vwWq8fQ-o9RTopgcZtAC_psm1aYyMKxkv47GOkdU",
  "description":"An AIS STS token is minted for fop-shengjiang (from fake-oidc-provider) and will be valid for 11h59m49.438314611s",
  "resource":"AIS STS token",
  "response":"Success",
  "time":"2022-11-22T18:31:37.084205362+00:00",
  "user":{
    "groups":[
      "group-claim-1",
      "group-claim-2"
      ],
    "identity":"fop-shengjiang",
    "issuer":"fake-oidc-provider"
    },
  "userAgent":"Go-http-client/2.0"
}