A security engineer needs to configure Cloud Audit Logging to monitor user activity on Google Cloud Storage buckets and then inspect the resulting audit records. What is the correct sequence of steps to enable Data Access audit logging and view these logs?
- 1Navigate to IAM & Admin > Audit Logs in the Google Cloud Console.
- 2Select Google Cloud Storage from the service list, enable Data Read and Data Write audit log types, and save.
- 3Perform an object read or write operation in a Cloud Storage bucket within the project.
- 4Open Logs Explorer and filter logs using the query logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access".
Answer
The correct order is: 1. Navigate to IAM & Admin > Audit Logs in the Google Cloud Console. 2. Select Google Cloud Storage from the service list, enable Data Read and Data Write audit log types, and save. 3. Perform an object read or write operation in a Cloud Storage bucket within the project. 4. Open Logs Explorer and filter logs using the query logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access".
To inspect Data Access audit logs, an administrator must first navigate to IAM & Admin > Audit Logs and explicitly enable Data Read/Data Write logs for Cloud Storage, because Data Access audit logging is turned off by default. Once enabled, performing an operation generates log entries that are subsequently viewable in Logs Explorer under the cloudaudit.googleapis.com/data_access log stream.
Step-by-Step Solution
Key Concept
Configuring and Analyzing Data Access Cloud Audit Logs
Estimated Time:1m 0s