This page provides supplemental information for using [Cloud Audit Logs](https://docs.cloud.google.com/logging/docs/audit.md.txt) with Cloud Storage. Use Cloud Audit Logs to generate logs for API operations performed in Cloud Storage. > [!NOTE] > **Note:** Cloud Audit Logs is separate from [Cloud Storage usage logs](https://docs.cloud.google.com/storage/docs/access-logs.md.txt). Both features provide information about who accesses your Cloud Storage resources, but Cloud Audit Logs is the [recommended method for doing so](https://docs.cloud.google.com/storage/docs/access-logs.md.txt#should-you-use). ## Overview Google Cloud services write audit logs to help you answer the questions, "Who did what, where, and when?" within your Google Cloud resources. You can also attach custom information to audit logs for more granular information about how your resources are accessed. Your Google Cloud projects contain only the audit logs for resources that are directly within the Google Cloud project. Other Google Cloud resources, such as folders, organizations, and billing accounts, contain the audit logs for the entity itself. For a general overview of Cloud Audit Logs, see [Cloud Audit Logs overview](https://docs.cloud.google.com/logging/docs/audit.md.txt). For a deeper understanding of the audit log format, see [Understand audit logs](https://docs.cloud.google.com/logging/docs/audit/understanding-audit-logs.md.txt). ## Available audit logs The following types of audit logs are available for Cloud Storage: - [Admin Activity audit logs](https://docs.cloud.google.com/logging/docs/audit.md.txt#admin-activity): Entries for user-driven operations that modify the configuration or metadata of Cloud Storage resources. - [Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit.md.txt#data-access): Entries for user-driven operations that are not tracked in Admin Activity audit logs. There are several sub-types of Data Access audit logs: - `ADMIN_READ`: Entries for operations that read the configuration or metadata of Cloud Storage resources. - `DATA_READ`: Entries for operations that read user-provided Cloud Storage resource data. - `DATA_WRITE`: Entries for operations that modify user-provided Cloud Storage resource data. To receive Data Access audit logs, you must [explicitly enable](https://docs.cloud.google.com/logging/docs/audit/configure-data-access.md.txt) them. - [System Event audit logs](https://docs.cloud.google.com/logging/docs/audit.md.txt#system-event): Entries for operations that modify Cloud Storage resources. These are generated by Google Cloud systems and not driven by user action. > [!IMPORTANT] > **Important:** Operations that read or modify object data, such as deleting objects, generate Data Access audit logs, not Admin Activity audit logs. If you don't enable Data Access audit logs, Cloud Audit Logs doesn't record who performed these operations. Additionally, Cloud Audit Logs doesn't generate logs for access granted through `allUsers` or `allAuthenticatedUsers`, even if you enable Data Access audit logs. To track this type of access, use [Cloud Storage usage logs](https://docs.cloud.google.com/storage/docs/access-logs.md.txt). For more information, see [Restrictions](https://docs.cloud.google.com/storage/docs/audit-logging.md.txt#restrictions). In addition to audit logs for Cloud Storage, Cloud Audit Logs can create audit logs for Storage Insights. For fuller descriptions of the audit log types, see [Types of audit logs](https://docs.cloud.google.com/logging/docs/audit.md.txt#types). ## Audited operations The following table summarizes which Cloud Storage operations correspond to each audit log type: > [!NOTE] > **Note:** The following table provides an approximate mapping of Cloud Storage operations to Cloud Audit Logs logs. Cloud Audit Logs logs are generated based on the IAM permissions that get checked in the course of completing the Cloud Storage request. This means that some Cloud Storage requests can generate more than one Cloud Audit Logs log. Refer to the Cloud Storage page [IAM permissions for JSON methods](https://docs.cloud.google.com/storage/docs/access-control/iam-json.md.txt) for a list of permissions that apply to different methods.
| Audit log type | Sub-type | Cloud Storage operations | |---|---|---| | Admin Activity | `ADMIN_WRITE` | - Setting bucket or managed folder IAM policies - Setting object ACLs^1^ - Creating buckets - Deleting buckets - Restoring soft-deleted buckets - Relocating buckets - Updating bucket metadata - Creating tag bindings on buckets - Deleting tag bindings on buckets - Creating managed folders - Deleting managed folders - Updating Storage Intelligence configuration for a project, a folder, or an organization - Creating Rapid Cache caches - Pausing Rapid Cache caches - Resuming Rapid Cache caches - Disabling Rapid Cache caches - Updating Rapid Cache caches - Creating HMAC keys - Deleting HMAC keys - Updating HMAC keys - Cancelling long-running operations - Deleting long-running operations - Creating Storage Insights inventory report configurations - Updating Storage Insights inventory report configurations - Deleting Storage Insights inventory report configurations - Creating Storage Insights dataset configurations - Updating Storage Insights dataset configurations - Deleting Storage Insights dataset configurations - Linking Storage Insights dataset configurations - Unlinking Storage Insights dataset configurations | | Data Access | `ADMIN_READ` | - Getting bucket or managed folder IAM policies - Getting object ACLs - Getting bucket metadata - Listing buckets - Listing tag bindings on buckets - Listing effective tags on buckets - Getting managed folder metadata - Listing managed folders - Getting Storage Intelligence configuration for a project, a folder, or an organization - Getting Rapid Cache caches - Listing Rapid Cache caches - Getting HMAC keys - Listing HMAC keys - Getting long-running operations - Listing long-running operations - Getting Storage Insights inventory report configurations - Listing Storage Insights inventory report configurations - Getting Storage Insights inventory reports - Listing Storage Insights inventory reports - Getting Storage Insights dataset configurations - Listing Storage Insights dataset configurations | | Data Access | `DATA_READ` | - Getting object data - Getting object metadata - Listing objects - Getting folder metadata - Listing folders - Copying objects^2^ - Composing objects^2^ - Listing ongoing XML API multipart uploads - Listing XML API multipart upload parts | | Data Access | `DATA_WRITE` | - Creating objects - Deleting objects - Deleting multiple objects using the XML API - Restoring soft-deleted objects - Moving objects - Updating non-ACL object metadata - Setting retentions for objects - Overriding unlocked retentions for objects - Copying objects^2^ - Composing objects^2^ - Initiating XML API multipart uploads - Creating parts in an XML API multipart upload - Aborting XML API multipart uploads - Completing XML API multipart uploads - Creating folders - Deleting folders - Renaming folders | | System Event | | - Start of bucket relocate process^3^ - End of bucket relocate process |
^1^ Admin Activity audit logs are not generated if/when ACLs are initially set at object creation. ^2^ These operations involve both reading and writing data. As a result, these operations each generate two log entries. ^3^ Bucket relocate might not start immediately after the initial request. The system event log gets written when the process actually begins. ### Restrictions The following restrictions apply to Cloud Audit Logs with Cloud Storage: - Cloud Audit Logs doesn't track access to resources that are public through `allUsers` or `allAuthenticatedUsers`, even if you enable Data Access audit logs. - Cloud Audit Logs does not track changes made by the [Object Lifecycle Management](https://docs.cloud.google.com/storage/docs/lifecycle.md.txt) or [Autoclass](https://docs.cloud.google.com/storage/docs/autoclass.md.txt) features. - Data Access logs generated from [authenticated browser downloads](https://docs.cloud.google.com/storage/docs/request-endpoints.md.txt#cookieauth) have their `principalEmail` and `callerIp` fields redacted when the download occurs outside of the Google Cloud console. If you need logging capabilities in one of these cases, consider using [Cloud Storage usage logs](https://docs.cloud.google.com/storage/docs/access-logs.md.txt). ## Audit log format Audit log entries include the following components: - The log entry itself, which is a [`LogEntry`](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry.md.txt) object. Useful fields include the following: - The `logName` contains the resource ID and audit log type. - The `resource` contains the target of the audited operation. - The `timestamp` contains the time of the audited operation. - The `protoPayload` contains the audited information. - The audit logging data, which is an [`AuditLog`](https://docs.cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog.md.txt) object held in the `protoPayload` field of the log entry. - Within the `protoPayload` field, the `metadata` field includes information specific to Cloud Storage. For example, a rewrite operation's object GET request's log includes a `destination` field in the `metadata` field of its audit log to specify the bucket where the data has been copied to. - Within the `protoPayload` field, additional audit information specific to Cloud Storage is included in the request and response fields when [Detailed audit logging mode](https://docs.cloud.google.com/storage/docs/org-policy-constraints.md.txt#audit-logging) is enforced. Note that you don't need to enforce detailed audit logging to attach custom information to audit logs. For other fields in these objects, and how to interpret them, see [Understand audit logs](https://docs.cloud.google.com/logging/docs/audit/understanding-audit-logs.md.txt). ### Log name Cloud Audit Logs log names include resource identifiers indicating the Google Cloud project or other Google Cloud entity that owns the audit logs, and whether the log contains Admin Activity or Data Access audit logging data. The following are the audit log names, including variables for the resource identifiers: ``` projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Factivity projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Factivity folders/FOLDER_ID/logs/cloudaudit.googleapis.com%2Fdata_access billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Factivity billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com%2Fdata_access organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Factivity organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com%2Fdata_access ``` > [!NOTE] > **Note:** The part of the log name following `/logs/` must be URL-encoded. The forward-slash character, `/`, must be written as `%2F`. ### Service name Cloud Storage audit logs use the service name `storage.googleapis.com`. Storage Insights audit logs use the service name `storageinsights.googleapis.com`. For a list of all the Cloud Logging API service names and their corresponding monitored resource type, see [Map services to resources](https://docs.cloud.google.com/logging/docs/api/v2/resource-list.md.txt#service-names). ### Resource types Cloud Storage audit logs use the resource type `gcs_bucket`. For a list of all the Cloud Logging monitored resource types and descriptive information, see [Monitored resource types](https://docs.cloud.google.com/logging/docs/api/v2/resource-list.md.txt#resource-types). ### Audit logs for multi-object delete XML API When you use the XML API to delete multiple objects in a single request, Cloud Storage generates two types of data access audit logs, provided you [enable data access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access.md.txt): - **Parent request audit log**: A log is generated for the overall multi-object delete request. It contains information about the request, including error response codes and messages for any child requests that failed. Successful child request details are not included in this log. - **Child request audit logs** : A separate log is generated for each individual object deletion within the multi-object delete request. These logs are in the same format as audit logs generated by any deletion method. Each child request audit log includes a unique identifier, called a `parentRequestId` field that links it to the corresponding parent request audit log. You can use [exemption principles](https://docs.cloud.google.com/logging/docs/audit/configure-data-access.md.txt#config-console-exempt) to exclude specific audit logs, such as parent or child audit logs, to help manage logging costs. ## Enable audit logging Admin Activity audit logs are enabled by default; you can't disable them. Data Access audit logs are disabled by default and aren't written unless explicitly enabled. For information about enabling some or all of your Data Access audit logs, see [Configure Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access.md.txt). ## Permissions and roles [IAM](https://docs.cloud.google.com/iam/docs.md.txt) permissions and roles determine your ability to access audit logs data in Google Cloud resources. When deciding which [Logging-specific permissions and roles](https://docs.cloud.google.com/logging/docs/access-control.md.txt#permissions_and_roles) apply to your use case, consider the following: - The Logs Viewer role (`roles/logging.viewer`) gives you read-only access to Admin Activity, Policy Denied, and System Event audit logs. If you have just this role, you cannot view Data Access audit logs that are in the `_Required` and `_Default` buckets. - The Private Logs Viewer role`(roles/logging.privateLogViewer`) includes the permissions contained in `roles/logging.viewer`, plus the ability to read Data Access audit logs in the `_Required` and `_Default` buckets. Note that if these private logs are stored in user-defined buckets, then any user who has permissions to read logs in those buckets can read the private logs. For more information about log buckets, see [Routing and storage overview](https://docs.cloud.google.com/logging/docs/routing/overview.md.txt). For more information about the IAM permissions and roles that apply to audit logs data, see [Access control with IAM](https://docs.cloud.google.com/logging/docs/access-control.md.txt). > [!NOTE] > **Note:** [Access Control Lists (ACLs)](https://docs.cloud.google.com/storage/docs/access-control/lists.md.txt) cannot be used to grant users access to view Admin Activity or Data Access audit logs. ## Viewing logs You can query for all audit logs or you can query for logs by their audit log name. The audit log name includes the [resource identifier](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects.md.txt#identifying_projects) of the Google Cloud project, folder, billing account, or organization for which you want to view audit logging information. Your queries can specify indexed [`LogEntry`](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/LogEntry.md.txt) fields. For more information about querying your logs, see [Build queries in the Logs Explorer](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt) The Logs Explorer lets you view filter individual log entries. If you want to use SQL to analyze groups of log entries, then use the **Log Analytics** page. For more information, see: - [Query and view logs in Observability Analytics](https://docs.cloud.google.com/logging/docs/analyze/query-and-view.md.txt). - [Sample queries for security insights](https://docs.cloud.google.com/logging/docs/analyze/analyze-audit-logs.md.txt). - [Chart query results](https://docs.cloud.google.com/logging/docs/analyze/charts.md.txt). Most audit logs can be viewed in Cloud Logging by using the Google Cloud console, the Google Cloud CLI, or the Logging API. However, for audit logs related to billing, you can only use the Google Cloud CLI or the Logging API. ### Console In the Google Cloud console, you can use the Logs Explorer to retrieve your audit log entries for your Google Cloud project, folder, or organization: 1. In the Google Cloud console, go to the **Logs Explorer** page: [Go to **Logs Explorer**](https://console.cloud.google.com/logs/query)
If you use the search bar to find this page, then select the result whose subheading is **Logging**. 2. Select an existing Google Cloud project, folder, or organization. 3. To display all audit logs, enter either of the following queries into the query-editor field, and then click **Run query**: ``` logName:"cloudaudit.googleapis.com" ``` ``` protoPayload."@type"="type.googleapis.com/google.cloud.audit.AuditLog" ``` 4. To display the audit logs for a specific resource and audit log type, in the **Query builder** pane, do the following: - In **Resource type**, select the Google Cloud resource whose audit logs you want to see. - In **Log name**, select the audit log type that you want to see: - For Admin Activity audit logs, select **activity**. - For Data Access audit logs, select **data_access**. - For System Event audit logs, select **system_event**. - For Policy Denied audit logs, select **policy**. - Click **Run query**. If you don't see these options, then there aren't any audit logs of that type available in the Google Cloud project, folder, or organization. If you're experiencing issues when trying to view logs in the Logs Explorer, see the [troubleshooting](https://docs.cloud.google.com/logging/docs/view/logs-explorer-interface.md.txt#troubleshooting) information. For more information about querying by using the Logs Explorer, see [Build queries in the Logs Explorer](https://docs.cloud.google.com/logging/docs/view/building-queries.md.txt). ### gcloud The Google Cloud CLI provides a command-line interface to the Logging API. Supply a valid resource identifier in each of the log names. For example, if your query includes a PROJECT_ID, then the project identifier you supply must refer to the currently selected Google Cloud project. To read your Google Cloud project-level audit log entries, run the following command: ``` gcloud logging read "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" \ --project=PROJECT_ID ``` To read your folder-level audit log entries, run the following command: ``` gcloud logging read "logName : folders/FOLDER_ID/logs/cloudaudit.googleapis.com" \ --folder=FOLDER_ID ``` To read your organization-level audit log entries, run the following command: ``` gcloud logging read "logName : organizations/ORGANIZATION_ID/logs/cloudaudit.googleapis.com" \ --organization=ORGANIZATION_ID ``` To read your Cloud Billing account-level audit log entries, run the following command: ``` gcloud logging read "logName : billingAccounts/BILLING_ACCOUNT_ID/logs/cloudaudit.googleapis.com" \ --billing-account=BILLING_ACCOUNT_ID ``` Add the [`--freshness` flag](https://docs.cloud.google.com/sdk/gcloud/reference/logging/read.md.txt#--freshness) to your command to read logs that are more than 1 day old. For more information about using the gcloud CLI, see [`gcloud logging read`](https://docs.cloud.google.com/sdk/gcloud/reference/logging/read.md.txt). ### REST When building your queries, supply a valid resource identifier in each of the log names. For example, if your query includes a PROJECT_ID, then the project identifier you supply must refer to the currently selected Google Cloud project. For example, to use the Logging API to view your project-level audit log entries, do the following: 1. Go to the **Try this API** section in the documentation for the [`entries.list`](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/entries/list.md.txt) method. 2. Put the following into the **Request body** part of the **Try this API** form. Clicking this [prepopulated form](https://docs.cloud.google.com/logging/docs/reference/v2/rest/v2/entries/list.md.txt?apix_params=%7B%22resource%22:%7B%22resourceNames%22:%5B%22projects/%5BPROJECT_ID%5D%22%5D,%22pageSize%22:5,%22filter%22:%22logName%3D(projects/%5BPROJECT_ID%5D/logs/cloudaudit.googleapis.com%252Factivity+OR+projects/%5BPROJECT_ID%5D/logs/cloudaudit.googleapis.com%252Fsystem_events+OR+projects/%5BPROJECT_ID%5D/logs/cloudaudit.googleapis.com%252Fdata_access)%22%7D%7D) automatically fills the request body, but you need to supply a valid PROJECT_ID in each of the log names. ``` { "resourceNames": [ "projects/PROJECT_ID" ], "pageSize": 5, "filter": "logName : projects/PROJECT_ID/logs/cloudaudit.googleapis.com" } ``` 3. Click **Execute**. ## Add custom information to audit logs You can attach custom information to requests for inclusion in audit logs by including the `x-goog-custom-audit-KEY: VALUE` header in your request. XML API requests additionally support the usage of a `x-goog-custom-audit-KEY=VALUE` query parameter. Custom information is added to the `metadata` field of the `protoPayload` in the audit log entry. When adding custom audit information, note the following considerations: - Each `KEY`, with the inclusion of the `x-goog-custom-audit-` prefix, can contain up to 64 characters, while each `VALUE` can contain up to 1,200 characters. - Each request can contain up to 4 header or parameter entries combined. ### Example header entries The following list shows examples of key-value pairs you can include in header entries: - `x-goog-custom-audit-job: test-job-id-here` - `x-goog-custom-audit-user: user ID test 1` - `x-goog-custom-audit-internal-user-id: MATR2022-11` - `x-goog-custom-audit-tracking-ticket: TT/1516512851` - `x-goog-custom-audit-justification: Removed customer identity record at customer request` - `x-goog-custom-audit-customer-id: USCU12315154` ### Example requests ### Command line ``` gcloud storage hash gs://example_bucket/example_object.jpeg --additional-headers=x-goog-custom-audit-job="job name",x-goog-custom-audit-user="test user" ``` ### Client libraries ### C++ To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### C# To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### Go To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### Java To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### Node.js To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### PHP To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### Python To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### Ruby To learn how to add custom headers to requests, see [Add custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). ### REST APIs ### JSON API ``` curl -X GET "https://storage.googleapis.com/storage/v1/b/example_bucket/o/example_object" \ -H "Authorization: Bearer ya29.AHES6ZRVmB7fkLtd1XTmq6mo0S1wqZZi3-Lh_s-6Uw7p8vtgSwg" \ -H "x-goog-custom-audit-job: job name" \ -H "x-goog-custom-audit-user: test user" ``` ### XML API ``` curl -X GET "https://storage.googleapis.com/example_bucket/example_object" \ -H "Authorization: Bearer ya29.AHES6ZRVmB7fkLtd1XTmq6mo0S1wqZZi3-Lh_s-6Uw7p8vtgSwg" \ -H "x-goog-custom-audit-job: job name" \ -H "x-goog-custom-audit-user: test user" ``` ### Signed URL requests ``` curl -X GET 'storage.googleapis.com/example_bucket?X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=example%40example-project.iam.gserviceaccount.com%2F20181026%2Fus-central1%2Fstorage%2Fgoog4_request&X-Goog-Date=20181026T181309Z&X-Goog-Expires=900&X-Goog-SignedHeaders=host,x-goog-custom-audit-job,x-goog-custom-audit-user&X-Goog-Signature=247a2aa45f169edf4d187d54e7cc46e4731b1e6273242c4f4c39a1d2507a0e58706e25e3a85a7dbb891d62afa8496def8e260c1db863d9ace85ff0a184b894b117fe46d1225c82f2aa19efd52cf21d3e2022b3b868dcc1aca2741951ed5bf3bb25a34f5e9316a2841e8ff4c530b22ceaa1c5ce09c7cbb5732631510c20580e61723f5594de3aea497f195456a2ff2bdd0d13bad47289d8611b6f9cfeef0c46c91a455b94e90a66924f722292d21e24d31dcfb38ce0c0f353ffa5a9756fc2a9f2b40bc2113206a81e324fc4fd6823a29163fa845c8ae7eca1fcf6e5bb48b3200983c56c5ca81fffb151cca7402beddfc4a76b133447032ea7abedc098d2eb14a7' \ -H "x-goog-custom-audit-job: job name" \ -H "x-goog-custom-audit-user: test user" ``` Note that the custom audit headers must also be included in `X-Goog-SignedHeaders`. To create a signed URL request that supports the addition of custom audit headers, the custom audit headers you want to use in the request must also be included when you [generate the signed URL](https://docs.cloud.google.com/storage/docs/access-control/signing-urls-with-helpers.md.txt). For example: ``` gcloud storage sign-url gs://example_bucket/example_object.jpeg --private-key-file=example-key.json --duration=10m --headers=x-goog-custom-audit-job:"job name",x-goog-custom-audit-user="test user" ``` You can also [use client libraries to generate the signed URL](https://docs.cloud.google.com/storage/docs/access-control/signing-urls-with-helpers.md.txt#client-libraries) when you [set custom headers](https://docs.cloud.google.com/storage/docs/troubleshooting.md.txt#custom-headers). As an alternative to using signed headers, you can use query parameters to pass custom audit entries. ``` curl -X GET 'storage.googleapis.com/example_bucket?X-Goog-Custom-Audit-Key=Value&X-Goog-Algorithm=GOOG4-RSA-SHA256&X-Goog-Credential=example%40example-project.iam.gserviceaccount.com%2F20181026%2Fus-central1%2Fstorage%2Fgoog4_request&X-Goog-Date=20181026T181309Z&X-Goog-Expires=900&X-Goog-SignedHeaders=host&X-Goog-Signature=247a2aa45f169edf4d187d54e7cc46e4731b1e6273242c4f4c39a1d2507a0e58706e25e3a85a7dbb891d62afa8496def8e260c1db863d9ace85ff0a184b894b117fe46d1225c82f2aa19efd52cf21d3e2022b3b868dcc1aca2741951ed5bf3bb25a34f5e9316a2841e8ff4c530b22ceaa1c5ce09c7cbb5732631510c20580e61723f5594de3aea497f195456a2ff2bdd0d13bad47289d8611b6f9cfeef0c46c91a455b94e90a66924f722292d21e24d31dcfb38ce0c0f353ffa5a9756fc2a9f2b40bc2113206a81e324fc4fd6823a29163fa845c8ae7eca1fcf6e5bb48b3200983c56c5ca81fffb151cca7402beddfc4a76b133447032ea7abedc098d2eb14a7' ``` These query parameters must be included when you [generate the signed URL](https://docs.cloud.google.com/storage/docs/access-control/signing-urls-with-helpers.md.txt). For example: ``` gcloud storage sign-url gs://example_bucket/example_object.jpeg --private-key-file=example-key.json --duration=10m --query-params=x-goog-custom-audit-job=job_name,x-goog-custom-audit-user=test_user ``` ### Example log entry ``` protoPayload: { @type: "type.googleapis.com/google.cloud.audit.Auditlog", ... metadata: { audit_context: { app_context: "EXTERNAL", audit_info: { x-goog-custom-audit-job: "job name", x-goog-custom-audit-user: "test user" } } } } ``` For more information on the fields included in the `protoPayload` object with the type `type.googleapis.com/google.cloud.audit.Auditlog`, see the [`AuditLog` reference documentation](https://docs.cloud.google.com/logging/docs/reference/audit/auditlog/rest/Shared.Types/AuditLog.md.txt). ## Route audit logs You can [route audit logs](https://docs.cloud.google.com/logging/docs/routing/overview.md.txt) to supported destinations in the same way that you can route other kinds of logs. Here are some reasons you might want to route your audit logs: - To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub. Using Pub/Sub, you can route to other applications, other repositories, and to third parties. - To manage your audit logs across an entire organization, you can create [aggregated sinks](https://docs.cloud.google.com/logging/docs/export/aggregated_sinks.md.txt) that can route logs from any or all Google Cloud projects in the organization. - If your enabled Data Access audit logs are pushing your Google Cloud projects over your [free allotment](https://docs.cloud.google.com/logging/pricing#pricing-summary), you can create sinks that exclude the Data Access audit logs from Logging. For instructions about routing logs, see [Configure and manage sinks](https://docs.cloud.google.com/logging/docs/export/configure_export_v2.md.txt). ## Pricing For information about Cloud Logging pricing, see [Google Cloud Observability pricing: Cloud Logging](https://docs.cloud.google.com/logging/pricing#logging-costs).