Question

Difficulty: EasyViewing and Analyzing Cloud Audit Logs

A security engineer needs to configure Cloud Audit Logging to monitor user activity on Google Cloud Storage buckets and then inspect the resulting audit records. What is the correct sequence of steps to enable Data Access audit logging and view these logs?

  1. 1Navigate to IAM & Admin > Audit Logs in the Google Cloud Console.
  2. 2Select Google Cloud Storage from the service list, enable Data Read and Data Write audit log types, and save.
  3. 3Perform an object read or write operation in a Cloud Storage bucket within the project.
  4. 4Open Logs Explorer and filter logs using the query logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access".

Answer

The correct order is: 1. Navigate to IAM & Admin > Audit Logs in the Google Cloud Console. 2. Select Google Cloud Storage from the service list, enable Data Read and Data Write audit log types, and save. 3. Perform an object read or write operation in a Cloud Storage bucket within the project. 4. Open Logs Explorer and filter logs using the query logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access".
To inspect Data Access audit logs, an administrator must first navigate to IAM & Admin > Audit Logs and explicitly enable Data Read/Data Write logs for Cloud Storage, because Data Access audit logging is turned off by default. Once enabled, performing an operation generates log entries that are subsequently viewable in Logs Explorer under the cloudaudit.googleapis.com/data_access log stream.

Step-by-Step Solution

1
Open the central Audit Logs settings page
Accesses project-level audit log configuration options
Centralized audit log management for all GCP services is located under IAM & Admin > Audit Logs.
2
Enable Cloud Storage Data Access logging
Activates Data Read and Data Write audit record generation for Cloud Storage
Data Access logs are turned off by default to prevent unexpected log storage costs.
3
Generate audit log activity
Creates log events in the Cloud Logging ingestion stream
Audit logs only record events occurring after logging has been enabled.
4
Query the generated logs in Logs Explorer
Displays Data Access audit log entries matching the Cloud Storage operations
Data Access logs are written to the cloudaudit.googleapis.com/data_access log filter path.

Key Concept

Configuring and Analyzing Data Access Cloud Audit Logs
Estimated Time:1m 0s
Rate this question