Penyimpanan objek (OBJ)

Log audit penyimpanan objek (OBJ) di Google Distributed Cloud (GDC) dengan air gap memungkinkan Anda melacak akses data dan aktivitas administratif di seluruh bucket dan objek penyimpanan. Log audit server Kubernetes API dan penyimpanan objek mencatat identitas pemanggil, resource target atau tindakan, stempel waktu, alamat IP sumber, dan status respons untuk pembacaan dan penulisan objek, pengelolaan bucket, dan update kontrol akses.

Lokasi workload	Penyimpanan objek
Sumber log audit	Penyimpanan objek
Operasi yang diaudit	Menghapus objek Membaca objek Memasukkan objek ke dalam bucket Mencantumkan objek Membuat bucket Menghapus bucket Membaca metadata bucket Memperbarui metadata bucket Memberikan dan mencabut akses ke bucket Membuat bucket Mem-patch bucket Menghapus bucket

Menghapus objek

Jenis log: Akses data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"OBJECT_DELETE"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"OBJECT_DELETE"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
"pid":"-",
"msgid":"-",
"extradata":"-",
"message":"{
  "time":"2022-11-09T15:25:26.781513Z",
  "auditID":"6a5542fd-cc1e-46b1-aa8d-514c650eba37",
  "user":{"identity":"Alice"},
  "resource":"x1vdn-bucket-for-testing-1",
  "action":"OBJECT_DELETE",
  "description":"{
    "tenantId":"23500289276650416831",
    "storageClass":"standard",
    "workloadType":"user"
    }",
  "sourceIPs":["10.21.21.30"],
  "response":"SUCS",
  "_gdch_org":"org-1-admin"
  }",
"_gdch_flbProcessedTimestamp":1668007526.781513,
"time":"2022-11-09T15:25:26.781513Z",
"pri":"14",
"_gdch_cluster":"org-1-admin",
"host":"objectstorage",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7hwsp",
"ident":"objectstorage",
"_gdch_service_name":"admin-audit-logs"
}

Membaca objek

Jenis log: Akses data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"OBJECT_READ"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"OBJECT_READ"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
"pid":"-",
"msgid":"-",
"extradata":"-",
"message":"{
  "time":"2022-11-09T15:25:26.781513Z",
  "auditID":"6a5542fd-cc1e-46b1-aa8d-514c650eba37",
  "user":{"identity":"Alice"},
  "resource":"x1vdn-bucket-for-testing-1",
  "action":"OBJECT_READ",
  "description":"{
    "objectSize":4,
    "tenantId":"23500289276650416831"
    "storageClass":"standard",
    "workloadType":"user"
    }",
  "sourceIPs":["10.21.21.30"],
  "response":"SUCS",
  "numBytesSent":4
  "_gdch_org":"org-1-admin"
  }",
"_gdch_flbProcessedTimestamp":1668007526.781513,
"time":"2022-11-09T15:25:26.781513Z",
"pri":"14",
"_gdch_cluster":"org-1-admin",
"host":"objectstorage",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7hwsp",
"ident":"objectstorage",
"_gdch_service_name":"admin-audit-logs"
}

Memasukkan objek ke dalam bucket

Jenis log: Akses data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"OBJECT_CREATE"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"OBJECT_CREATE"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
"pid":"-",
"msgid":"-",
"extradata":"-",
"message":"{
  "time":"2022-11-09T15:25:26.781513Z",
  "auditID":"6a5542fd-cc1e-46b1-aa8d-514c650eba37",
  "user":{"identity":"Alice"},
  "resource":"x1vdn-bucket-for-testing-1",
  "action":"OBJECT_CREATE",
  "description":"{
    "tenantId":"23500289276650416831"
    "storageClass":"standard",
    "workloadType":"user"
    }",
  "sourceIPs":["10.21.21.30"],
  "response":"SUCS",
  "numBytesReceived":4
  "_gdch_org":"org-1-admin"
  }",
"_gdch_flbProcessedTimestamp":1668007526.781513,
"time":"2022-11-09T15:25:26.781513Z",
"pri":"14",
"_gdch_cluster":"org-1-admin",
"host":"objectstorage",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7hwsp",
"ident":"objectstorage",
"_gdch_service_name":"admin-audit-logs"
}

Mencantumkan objek

Jenis log: Akses data.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"OBJECT_LIST"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"OBJECT_LIST"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
"pid":"-",
"msgid":"-",
"extradata":"-",
"message":"{
  "time":"2022-11-09T15:25:26.781513Z",
  "auditID":"6a5542fd-cc1e-46b1-aa8d-514c650eba37",
  "user":{"identity":"Alice"},
  "resource":"x1vdn-bucket-for-testing-1",
  "action":"OBJECT_LIST",
  "description":"{
    "tenantId":"23500289276650416831"
    "storageClass":"standard",
    "workloadType":"user"
    }",
  "sourceIPs":["10.21.21.30"],
  "response":"SUCS",
  "_gdch_org":"org-1-admin"
  }",
"_gdch_flbProcessedTimestamp":1668007526.781513,
"time":"2022-11-09T15:25:26.781513Z",
"pri":"14",
"_gdch_cluster":"org-1-admin",
"host":"objectstorage",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-7hwsp",
"ident":"objectstorage",
"_gdch_service_name":"admin-audit-logs"
}

Membuat bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"BUCKET_CREATE"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"BUCKET_CREATE"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "pri":"14",
  "time":"2022-11-30T19:21:47.577678Z",
  "host":"obj",
  "ident":"obj",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{
    "time":"2022-11-30T19:21:47.577678Z","auditID":"d3b0c42c-0a3d-4fc9-951a-c41b863058f2",
    "user":{
      "identity":"objectstorage-tenant-bucket-controller-standard-system-sa"
      },
      "resource":"syism-zakmiller-8-17-22",
      "action":"BUCKET_CREATE",
      "description":"{
        "tenantId":"63704411338737989311",
        "storageClass":"standard",
        "workloadType":"system"
        }",
      "sourceIPs":["10.2.2.34"],
      "response":"SUCS",
      "_gdch_org":"root-admin"
      }",
  "_gdch_cluster":"root-admin","_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-tfvcf","_gdch_service_name":"admin-audit-logs"
}

Menghapus bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"BUCKET_DELETE"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"BUCKET_DELETE"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "pri":"14",
  "time":"2022-11-30T19:21:47.577678Z",
  "host":"obj",
  "ident":"obj",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{
    "time":"2022-11-30T19:21:47.577678Z","auditID":"d3b0c42c-0a3d-4fc9-951a-c41b863058f2",
    "user":{
      "identity":"objectstorage-tenant-bucket-controller-standard-system-sa"
      },
      "resource":"syism-zakmiller-8-17-22",
      "action":"BUCKET_DELETE",
      "description":"{
        "tenantId":"63704411338737989311",
        "storageClass":"standard",
        "workloadType":"system"
        }",
      "sourceIPs":["10.2.2.34"],
      "response":"SUCS",
      "_gdch_org":"root-admin"
      }",
  "_gdch_cluster":"root-admin","_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-tfvcf","_gdch_service_name":"admin-audit-logs"
}

Membaca metadata bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"BUCKET_METADATA_READ"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"BUCKET_METADATA_READ"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "pri":"14",
  "time":"2022-11-30T19:21:47.577678Z",
  "host":"obj",
  "ident":"obj",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{
    "time":"2022-11-30T19:21:47.577678Z","auditID":"d3b0c42c-0a3d-4fc9-951a-c41b863058f2",
    "user":{
      "identity":"objectstorage-tenant-bucket-controller-standard-system-sa"
      },
      "resource":"syism-zakmiller-8-17-22",
      "action":"BUCKET_METADATA_READ",
      "description":"{
        "tenantId":"63704411338737989311",
        "storageClass":"standard",
        "workloadType":"system"
        }",
      "sourceIPs":["10.2.2.34"],
      "response":"SUCS",
      "_gdch_org":"root-admin"
      }",
  "_gdch_cluster":"root-admin","_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-tfvcf","_gdch_service_name":"admin-audit-logs"
}

Memperbarui metadata bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	message.user.identity	Misalnya, "message":"{"user":{"identity":"Alice"}}
Target (Kolom dan nilai yang memanggil API)	message.action	Misalnya, "message":"{"action":"BUCKET_METADATA_UPDATE"}"
Tindakan (Kolom yang berisi operasi yang dilakukan)	action	Misalnya, "action":"BUCKET_METADATA_UPDATE"
Stempel waktu peristiwa	time	Misalnya, "time":"2022-11-09T15:25:26.781513Z"
Sumber tindakan	message.sourceIPs	Misalnya, "message":"{"sourceIPs":["10.21.21.30"]}"
Hasil	message.response	Misalnya, "message":"{"response":"SUCS"}"
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log

{
  "pri":"14",
  "time":"2022-11-30T19:21:47.577678Z",
  "host":"obj",
  "ident":"obj",
  "pid":"-",
  "msgid":"-",
  "extradata":"-",
  "message":"{
    "time":"2022-11-30T19:21:47.577678Z","auditID":"d3b0c42c-0a3d-4fc9-951a-c41b863058f2",
    "user":{
      "identity":"objectstorage-tenant-bucket-controller-standard-system-sa"
        },
      "resource":"syism-zakmiller-8-17-22",
      "action":"BUCKET_METADATA_UPDATE",
      "description":"{
        "tenantId":"63704411338737989311",
        "storageClass":"standard",
        "workloadType":"system"
        }",
      "sourceIPs":["10.2.2.34"],
      "response":"SUCS",
      "_gdch_org":"root-admin"
      }",
  "_gdch_cluster":"root-admin","_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-tfvcf","_gdch_service_name":"admin-audit-logs"
}

Memberikan dan mencabut akses ke bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user": {"groups": ["system:masters", "system:authenticated"], "username":"kubernetes-admin"}
Target (Kolom dan nilai yang memanggil API)	requestURI	Misalnya, "requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/<namespace>/rolebindings?fieldSelector=metadata.name%3D<role-name>"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb":"create"
Stempel waktu peristiwa	time	Misalnya, "requestReceivedTimestamp":"2022-11-09T18:53:33.352930Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs":["10.21.21.28"]
Hasil	responseStatus	Misalnya, "responseStatus":{"code":201,"metadata":{}}
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log untuk memberikan akses

{
"stageTimestamp":"2022-11-09T18:53:33.421853Z",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-2bqjb",
"userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"verb":"create",
"sourceIPs": ["10.21.21.28"],
"requestReceivedTimestamp":"2022-11-09T18:53:33.352930Z",
"requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/gpc-system/rolebindings?fieldManager=kubectl-client-side-apply",
"stage":"ResponseComplete",
"_gdch_cluster":"org-1-admin",
"responseStatus":{
"code":201,
"metadata":{}
},
"user": {
    "groups": ["system:masters","system:authenticated"],
    "username":"kubernetes-admin"
    },
"objectRef":{
  "name":"alice-can-read",
  "apiGroup":"rbac.authorization.k8s.io",
    "namespace":"gpc-system",
    "resource":"rolebindings",
    "apiVersion":"v1"
        },
"Annotations":{
        "authorization.k8s.io/reason":"",
        "authorization.k8s.io/decision":"allow"
        },
"apiVersion":"audit.k8s.io/v1",
"kind":"Event",
"auditID":"066660c3-29d8-4cd3-bed8-0727ca1ba7a7",
"level":"Metadata",
"_gdch_flbProcessedTimestamp":1668020013.467199,
"_gdch_service_name":"apiserver"
}

Contoh log untuk mencabut akses

{
"sourceIPs": ["10.21.21.28"],
"_gdch_flbProcessedTimestamp":1668020014.507883,
"level":"Metadata",
"apiVersion":"audit.k8s.io/v1",
"auditID":"d0d42688-9e0e-4ed3-9a7f-d3c91c345640",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-5t1tx",
"kind":"Event",
"stageTimestamp":"2022-11-09T18:53:33.911438Z",
"userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"responseStatus":{
    "Details":{
        "kind":"rolebindings",
        "group":"rbac.authorization.k8s.io",
        "uid":"f00c521a-b65a-b65d-4f08-9082-de7837eda84c",
        "name":"alice-can-read"
        },
        "metadata":{},
        "status":"Success",
        "code":200
        }
"objectRef":{
    "resource":"rolebindings",
        "namespace":"gpc-system",
        "name":"alice-can-read",
"apiVersion":"v1",
        "apiGroup":"rbac.authorization.k8s.io"
        },
    "requestURI":"/apis/rbac.authorization.k8s.io/v1/namespaces/gpc/system/rolebindings/alice-can-read",
"requestReceivedTimestamp":"2022-11-09T18:53:33.773949X",
"user": {"username":"kubernetes-admin",
    "groups": ["system:masters", "system:authenticated"]
    },
"annotations": {
        "authorization.k8s.io/reason":"",
        "authorization.k8s.io/decision":"allow"
        },
"_gdch_cluster":"org-1-admin",
"stage":"ResponseComplete",
"verb":"delete",
"_gdch_service-name":"apiserver"
}

Membuat bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user":{"username":"kubernetes-admin", "groups": ["system:masters","system:authenticated"]}
Target (Kolom dan nilai yang memanggil API)	requestURI	Misalnya, "requestURI":"/apis/object.gdc.goog/v1/"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb":"create"
Stempel waktu peristiwa	time	Misalnya, "requestReceivedTimestamp":"2022-11-09T18:47:18.331288Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs":["10.21.21.30"]
Hasil	responseStatus	Misalnya, "responseStatus":{"metadata":{},"code":201}
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log untuk membuat bucket

{
"responseStatus":{"metadata":{},"code":201},
"_gdch_flbProcessedTimestamp":1668006515.011904,
"sourceIPs":["10.21.21.28"],
"stageTimestamp":"2022-11-09T14:48:05.433558Z",
"apiVersion":"audit.k8s.io/v1",
"annotations":{
  "authorization.k8.io/reason":"",
  "authorization.k8.io/decision":"allow"
  },
"objectRef":{
  "apiVersion":"v1",
  "namespace":"bucket-test-2",
  "resource":"buckets",
  "name":"bucket-for-testing-1",
  "apiGroup":"object.gdc.goog"
  },
"userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"kind":"Event",
"level":"Metadata",
"auditID":"c3b1897a-d1c9-4de8-b5e6-d7875ab3f318",
"stage":"ResponseComplete",
"requestURI":"/apis/object.gdc.goog/v1/namespace/bucket-test-2/buckets?fieldManager-kubectl-client-side-apply",
"requestReceivedTimestamp":"2022-11-09T14:48:05.283425Z",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-5tltx",
"_gdch_cluster":"org-1-admin",
"user":{
  "username":"kubernetes-admin",
  "groups": ["system:masters","system:authenticated"]
  },
"verb":"create",
"_gdch_service_name":"apiserver"
}

Mem-patch bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user":{"username":"kubernetes-admin", "groups": ["system:masters","system:authenticated"]}
Target (Kolom dan nilai yang memanggil API)	requestURI	Misalnya, "requestURI":"/apis/object.gdc.goog/v1/"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb":"patch"
Stempel waktu peristiwa	time	Misalnya, "requestReceivedTimestamp":"2022-11-09T18:47:18.331288Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs":["10.21.21.30"]
Hasil	responseStatus	Misalnya, "responseStatus":{"metadata":{},"code":201}
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log untuk melakukan patch pada bucket

{
"requestReceivedTimestamp":"2022-11-09T18:40:54.0865902",
"auditID":"c7219d20-64d1-4bfd-85a8-5a2f1b898fa8",
"sourceIPs":["10.21.21.2 8"],
"_gdch_flbProcessedTimestamp":1668019271.206281,
"requestURI":"/apis/object.gdc.goog/v1/namespaces/gpc-system/buckets/buck et-for-testing-1?fieldManager-kubectl -client-side-apply",
"responseStatus":{"code":200,"metadata":{}},
"apiVersion":"audit.k8s.io/v 1",
"objectRef":{
    "namespace":"gpc-system",
    "name":"bucket-for-testing-1",
    "apiVersion":"v1",
    "apiGroup":"object.gdc.goog",
    "resource":"buckets"
      },"
_gdch_cluster":"org-1-admin",
"annotations":{"authorization.k8s.io/reason":"","authorization.k8s.io/decision":"allow"},
"verb":"patch",
"stageTimestamp":"2022-11-09T18:40:54.1386612",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-5t1tx",
"userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"stage":"ResponseComplete",
"kind":"Event",
"user":{"username":"kubernetes-admin","groups":["system:masters", "system:authenticated"]},
"level":"Metadata",
"_gdch_service_name":"apiserver"
}

Menghapus bucket

Jenis log: Aktivitas admin.

Kolom dalam entri log yang berisi informasi audit
Metadata audit	Nama kolom audit	Nilai
Identitas pengguna atau layanan	user	Misalnya, "user":{"username":"kubernetes-admin", "groups": ["system:masters","system:authenticated"]}
Target (Kolom dan nilai yang memanggil API)	requestURI	Misalnya, "requestURI":"/apis/object.gdc.goog/v1/"
Tindakan (Kolom yang berisi operasi yang dilakukan)	verb	Misalnya, "verb":"delete"
Stempel waktu peristiwa	time	Misalnya, "requestReceivedTimestamp":"2022-11-09T18:47:18.331288Z"
Sumber tindakan	sourceIPs	Misalnya, "sourceIPs":["10.21.21.30"]
Hasil	responseStatus	Misalnya, "responseStatus":{"metadata":{},"code":201}
Kolom lain	Tidak berlaku	Tidak berlaku

Contoh log untuk menghapus bucket

{
"level":"Metadata",
"sourceIPs":["10.21.21.28"],
"_gdch_flbProcessedTimestamp":1668006515.011904,
"user":{"username":"kubernetes-admin",
"groups":["system:masters","system:authenticated"]},
"apiVersion":"audit.k8s.io/v1",
"stage":"ResponseComplete",
"auditID":"afce809c-fc06-4aac-b5af-654c91db6159",
"responseStatus":{"metadata":{},
    "code":200},
"stageTimestamp":"2022-11-09T18:47:18.530272Z",
"objectRef":{
    "namespace":"gpc-system",
    "resource":"buckets",
    "apiVersion":"v1",
    "apiGroup":"object.gdc.goog",
    "name":"bucket-for-testing-1",
  },
"requestURI":"/apis/object.gdc.goog/v1/namespaces/gpc-system/buckets/bucket-for-testing-1",
    "annotations"{"authorization.k8s.io/reason":"",
    "authorization.k8s.io/decision":"allow"
        },
"userAgent":"kubectl/v1.23.5 (linux/amd64) kubernetes/c285e78",
"kind":"Event",
"_gdch_cluster":"org-1-admin",
"_gdch_fluentbit_pod":"anthos-audit-logs-forwarder-5tltx",
"requestReceivedTimestamp":"2022-11-09T18:47:18.331288Z",
"verb":"delete",
"_gdch_service_name":"apiserver"
}