Key Management Service (KMS) audit logs in Google Distributed Cloud (GDC) air-gapped let you track control plane and data plane key management and cryptographic requests in organization workloads. Kubernetes audit logs, Service Mesh Envoy access logs, and KMS backend server logs record the user or service identity, target resource, action, and JSON payload fields for API server and cryptographic service operations.
| Workload location |
Organization only workloads |
| Audit log source |
|
| Audited operations |
|
API server
Log type: Control plane.
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | user |
For example, "user":{ "groups":["system:authenticated"], "username":"fop-platform-admin@example.com" } |
|
Target (Fields and values that call the API) |
objectRef |
"objectRef":{ "resource":"aeadkeys", "apiGroup":"kms.gdc.goog", "apiVersion":"v1", "namespace":"kms-test1" } |
|
Action (Fields containing the performed operation) |
verb |
For example,
|
| Event timestamp | requestReceivedTimestamp |
For example,
|
| Source of action | sourceIPs |
For example, "sourceIPs":[ "10.200.0.7" ] |
| Outcome | responseStatus |
For example, "responseStatus": { "metadata": {}, "code": 200 } |
| Other fields | Not applicable | Not applicable |
Example log
{
"user":{
"groups":["system:authenticated"],
"username":"fop-platform-admin@example.com"
},
"auditID":"bec33328-b4ba-431e-96a2-9bbb77666478",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-wxw7t",
"stage":"RequestReceived",
"_gdch_cluster":"org-1-admin",
"userAgent":"kubectl/v1.25.4 (linux/amd64) kubernetes/872a965",
"kind":"Event",
"level":"Metadata",
"stageTimestamp":"2022-12-08T03:59:20.025703Z",
"requestReceivedTimestamp":"2022-12-08T03:59:20.025703Z",
"objectRef":{
"resource":"aeadkeys",
"apiGroup":"kms.gdc.goog",
"apiVersion":"v1",
"namespace":"kms-test1"
},
"sourceIPs":[
"10.200.0.7"
],
"apiVersion":"audit.k8s.io/v1",
"requestURI":"/apis/kms.gdc.goog/v1/namespaces/kms-test1/aeadkeys?fieldManager=kubectl-client-side-apply&fieldValidation=Strict",
"verb":"create",
"_gdch_service_name":"apiserver"
}
Istio
Log type: Data plane.
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | username |
For example,
|
|
Target (Fields and values that call the API) |
resource |
"resource":{ "node_name":"sidecar~10.253.166.144~kms-backend-84f5c4f4c7-ncl4d.kms-system~kms-system.svc.cluster.local", "cluster_name":"kms-backend.kms-system", "zone_name":"europe-west4-b", "log_name":"otel_envoy_accesslog" } |
|
Action (Fields containing the performed operation) |
path |
For example,
|
| Event timestamp | start_time |
For example,
|
| Source of action | x_forwarded_for |
For example,
|
| Outcome | response_code |
For example,
|
| Other fields | Not applicable | Not applicable |
Example log
{
"response_code":"200",
"response_code_details":"via_upstream",
"response_flags":"-",
"route_name":"default",
"severity_number":0,
"severity_text":"",
"start_time":"2022-12-08T04:03:33.859Z",
"_gdch_service_name":"istio",
"upstream_host":"10.253.166.144:8080",
"upstream_local_address":"127.0.0.6:54383",
"user_agent":"grpc-go/1.49.0",
"_gdch_service_tenant":"platform-obs",
"username":"fop-platform-admin@example.com",
"x_envoy_upstream_service_time":"104",
"x_forwarded_for":"10.253.165.123",
"x_goog_api_client":"-",
"x_request_id":"c11cbf94-765d-440d-9d36-56654d93d834",
"authority":"kms.org-1.zone1.google.gdch.test",
"bytes_received":"32756",
"body":{},
"upstream_transport_failure_reason":"-",
"bytes_sent":"0",
"downstream_local_address":"10.253.166.144:8080",
"downstream_remote_address":"10.253.165.123:0",
"duration":"318",
"method":"POST",
"observed_time_unix_nano":0,
"protocol":"HTTP/2",
"requested_server_name":"outbound_.8080_._.kms-backend.kms-system.svc.cluster.local",
"_gdch_namespace":"istio-system",
"path":"/goog.gdc.kms.v1.CryptoOperationsService/Encrypt",
"connection_termination_details":"-",
"time_unix_nano":1670472213859570944,
"upstream_cluster":"inbound|8080||",
"resource":{
"node_name":"sidecar~10.253.166.144~kms-backend-84f5c4f4c7-ncl4d.kms-system~kms-system.svc.cluster.local",
"cluster_name":"kms-backend.kms-system",
"zone_name":"europe-west4-b",
"log_name":"otel_envoy_accesslog"
},
"_gdch_cluster":"org-1-admin",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-cr9h7"
}
Server
Log type: Data plane.
| Fields in the log entry that contain audit information | ||
|---|---|---|
| Audit metadata | Audit field name | Value |
| User or service identity | message.user.identity |
For example,
|
|
Target (Fields and values that call the API) |
_gdch_service_name |
|
|
Action (Fields containing the performed operation) |
message.action |
For example,
|
| Event timestamp | time |
For example,
|
| Source of action | _gdch_cluster |
For example,
|
| Outcome | message.response |
For example,
|
| Other fields | The message.description field contains the complete log message. |
For more information, see the Example log. |
Example log
{
"pri":"46",
"time":"2023-05-30T20:58:25Z",
"host":"kms-backend-9dd54b666-jfp5v",
"ident":"/kms_bin",
"pid":"1",
"msgid":"audit-log",
"extradata":"-",
"message":"{\"time\":\"2023-08-01T18:04:00.458810232Z\",\"auditID\":\"6f848640-8af1-4659-b9c9-a358d19bea5f\",\"user\":{\"identity\":\"fop-platform-admin@example.com\"},\"resource\":\"namespaces/testnamespace/aeadKeys/testcryptokey\",\"action\":\"/goog.gdc.kms.v1.CryptoOperationsService/Decrypt\",\"description\":\"{\"duration_ms\":202}\",\"userAgent\":\"grpc-go/1.55.0\",\"response\":\"OK\",\"_gdch_service\":\"kms\"}",
"_gdch_org_name":"org-1",
"_gdch_org_id":"org-1.zone1.google.gdch.test",
"_gdch_cluster":"org-1-admin",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-5lq2g",
"_gdch_service_name":"kms-backend",
"_gdch_tenant_id":"platform-obs"
}