Identity and access management (IAM)

Identity and Access Management (IAM) audit logs in Google Distributed Cloud (GDC) air-gapped record token key exchanges, resource access changes, and user session events. These log entries use Istio, Kubernetes Resource Model (KRM) API, and custom GKE Identity Service schemas to capture the identity, target resource, and action metadata.

Key exchange for STS token

Log schema: Istio

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity identity 

\"user\":{\"identity\":\"system:serviceaccount:iam-test:service-account\"}

Target

(Fields and values that call the API)

 resource 

\"resource\":\"service-accounts.zone1.google.gdch.test\"

Action

(Fields containing the performed operation)

 Not applicable
Event timestamp time 

"time": "2022-11-23T18:25:54Z"
Source of action Not applicable
Outcome Not applicable
Other fields Not applicable

Audit logs CRUD operations on Kubernetes resources including creation of service accounts, and access control management.

Log schema: KRM API

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity user/username 

"user": {
    "groups": [
      "system:authenticated"
    ],
    "username": "fop-platform-admin@example.com"
  }

Target

(Fields and values that call the API)

 objectRef 

"objectRef": {
    "resource": "projectserviceaccounts",
    "apiGroup": "resourcemanager.gdc.goog",
    "name": "service-accountt",
    "apiVersion": "v1alpha1",
    "namespace": "iam-test"
}

Action

(Fields containing the performed operation)

 verb 

"verb": "create"
Event timestamp requestReceivedTimestamp 

"requestReceivedTimestamp": "2022-11-23T18:24:26.514173Z"
Source of action sourceIPs 

"sourceIPs": [
    "10.200.0.2"
  ]
Outcome responseStatus 

"responseStatus": {
    "code": 201,
    "metadata": {}
  }
Other fields annotations/authorization.k8s.io/reason 

"annotations": {
    "authorization.k8s.io/reason": "RBAC: allowed by RoleBinding \"platform-admin-project-iam-admin/iam-test\" of Role \"project-iam-admin\" to User \"fop-platform-admin@example.com\"",
    "authorization.k8s.io/decision": "allow"
  }

Audit Log when a user logs out

Log schema: Custom AIS format.

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity payload.user 

"payload": {
      "expirationTime": "2023-08-29T12:42:36.848454939+00:00",
      "groups": [],
      "id": "7a5bea7a-0821-45d8-b4a0-69f24d30ab3f",
      "issuer": "Google OIDC",
      "user": "test-user"
    }

Target

(Fields and values that call the API)

 Not applicable

Action

(Fields containing the performed operation)

 operation 

"operation": "revoke"
Event timestamp metadata.timestamp 

"timestamp": "2023-08-29T00:42:40.000544813+00:00"
Source of action Not applicable
Outcome Not applicable
Other fields expirationTime 

"expirationTime": "2023-08-29T12:42:36.848454939+00:00"

Audit Log when a user logs in

Log schema: Custom AIS format.

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity payload.user 

"payload": {
      "expirationTime": "2023-08-29T05:22:13.350779831+00:00",
      "groups": [],
      "id": "dcb7c5d9-c171-4f5b-84b6-5c92bfffb0e0",
      "issuer": "Azure AD SAML",
      "user": "test-ais-e2e-saml@byoidcloudaccountgoogle.onmicrosoft.com"
    }

Target

(Fields and values that call the API)

 Not applicable

Action

(Fields containing the performed operation)

 operation 

"operation": "create"
Event timestamp metadata.timestamp 

"timestamp": "2023-08-28T17:22:13.351713088+00:00"
Source of action Not applicable
Outcome Not applicable
Other fields expirationTime 

"expirationTime": "2023-08-29T05:22:13.350779831+00:00"

Audit Log when PA revokes sessions for a user

Log schema: Custom AIS format.

Fields in the log entry that contain audit information
Audit metadata Audit field name Value
User or service identity payload.admin / payload.user 

"payload": {
      "admin": "test-user-1@gdch.com",
      "numSessionsAffected": 1,
      "peerWorkloadIdentity": "system:serviceaccount:anthos-identity-service:default",
      "peerWorkloadIdentityIssuer": "https://kubernetes.default.svc.cluster.local",
      "user": "test-user-2@gdch.com"
    }

Target

(Fields and values that call the API)

 resource 

"resource": "session"

Action

(Fields containing the performed operation)

 operation 

"operation": "revoke"
Event timestamp metadata.timestamp 

"timestamp": "2023-08-28T17:22:24.043644569+00:00"
Source of action Not applicable
Outcome Not applicable
Other fields numSessionsAffected 

"numSessionsAffected": 1

Example log IAM

{
  "pri": "46",
  "_gdch_flbProcessedTimestamp": 1669227957.340494,
  "_gdch_fluentbit_pod": "anthos-audit-logs-forwarder-vk6vx",
  "time": "2022-11-23T18:25:54Z",
  "message": "{\"time\":\"2022-11-23T18:25:54.257503516Z\",\"auditID\":\"d1c33645-bed0-47dc-8180-06b752673109\",\"user\":{\"identity\":\"system:serviceaccount:iam-test:service-accountt\"},\"resource\":\"service-accounts.zone1.google.gdch.test\",\"description\":\"{\\\"keyID\\\":\\\"f9540561-84d5-4113-983f-fd8868501596\\\",\\\"expirationTime\\\":\\\"2022-11-24T06:25:53Z\\\"}\"}",
  "ident": "/service-identity-server",
  "pid": "1",
  "msgid": "audit-log",
  "extradata": "-",
  "_gdch_cluster": "root-admin",
  "host": "serviceidentity-sa-server-55544bd9f5-nwg8m",
  "_gdch_service_name": "service-identity-audit-logs"
}