GKE Identity Service audit logs

GKE Identity Service acts as an authentication proxy in Google Distributed Cloud (GDC) air-gapped that lets you use existing identity providers for user authentication. The service generates JSON audit event logs that record the event ID, timestamp, user agent, target resource, and operation for authentication and session events.

JSON representation

{
  "description": string,
  "id": string,
  "metadata": object {
    "timestamp": string,
    "userAgent": string
  },
  "operation": string,
  "payload": object {},
  "resource": string
}

Fields
id	string A unique ID assigned to every audit event. For example, "d53270e7-d9e7-4d49-b16a-a5ed161c1469"
description	string A human-readable description of the event. For example, "An STS token was minted for user: 102405777051160536773"
resource	string The resource being audited. Allowed values are "session", "login_token", or "sts_token". For example, "sts_token"
operation	string The operation being performed on the resource. Allowed values are "create", "revoke", or "list". For example, "create"
metadata	object The metadata associated with the event.
userAgent	string The user-agent HTTP header, if applicable.
timestamp	string The timestamp at which the event was created. For example, "2022-12-16T00:53:32.005010538+00:00"
payload	object Arbitrary event-specific payload. For example, { "audience": "test-audience", "expirationTime": "2022-12-16T12:53:31.95180671+00:00", "issuer": "", "user": "102405777051160536773" "groups": [], "parentId": "8216278b-295e-4fef-af8d-a6c0a54d15e5" }