gcp-audit-logs

1# GCP Audit Logs
2 
3Audit GCP activity with Cloud Audit Logs for compliance, security investigation, and operational monitoring.
4 
5## When to Use
6 
7- Enabling organization-wide audit logging across GCP projects
8- Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP
9- Investigating unauthorized access or suspicious API activity
10- Setting up alerting on administrative and data access events
11- Exporting logs to BigQuery for long-term analysis and reporting
12 
13## Audit Log Types
14 
15```yaml
16log_types:
17  admin_activity:
18    description: API calls that modify resource configuration or metadata
19    enabled: Always (cannot be disabled)
20    retention: 400 days (default)
21    cost: No charge
22    examples:
23      - Creating or deleting VM instances
24      - Changing IAM policies
25      - Modifying firewall rules
26 
27  data_access:
28    description: API calls that read resource configuration, metadata, or user data
29    enabled: Must be explicitly enabled (except BigQuery)
30    retention: 30 days (default)
31    cost: Can be significant at high volume
32    subtypes:
33      ADMIN_READ: Read resource configuration/metadata
34      DATA_READ: Read user-provided data
35      DATA_WRITE: Write user-provided data
36 
37  system_event:
38    description: Actions performed by GCP systems on behalf of resources
39    enabled: Always (cannot be disabled)
40    retention: 400 days (default)
41    cost: No charge
42    examples:
43      - Live migration of VM instances
44      - Automatic scaling events
45 
46  policy_denied:
47…