Events in audit logs
In audit logs, an event is a record of a create, modify, or delete operation with resources and entities.Also, reads of sensitive data — passwords, certificates, and so on — are recorded in audit logs.
An event has a fixed structure and can be of different types.
Event structure
The event has a JSON structure:
{
"event_saved_time": "string",
"event_id": "string",
"event_type": "string",
"event_time": "string",
"status": "string",
"error_code": "string",
"request_id": "string",
"subject": {
"subject_id": "string",
"subject_type": "string",
"subject_name": "string",
"subject_auth_provider": "string",
"subject_is_authorized": boolean,
"subject_authorized_by": ["string", "string"],
"subject_credentials_fingerprint": "string"
},
"resource": {
"resource_id": "string",
"resource_type": "string",
"resource_name": "string",
"resource_account_id": "string",
"resource_project_id": "string",
"resource_location": "string",
"resource_changes_old_values": {},
"resource_changes_new_values": {}
}
},
"source_type": {"string"},
"request": {
"request_remote_address": "string",
"request_user_agent": "string",
"request_type": "string",
"request_path": "string",
"request_method": "string",
"request_parameters": "string"
},
"schema_version": "1.0"
}
Some fields are optional and may not be present in the event.Also, some fields have reserved values.
Event Fields
Reserved values
If the value of a field cannot be determined by the log source services — for example, if an error occurred during the execution of an action, or if the object has not yet been created and there is no resource_id
— the reserved value undefined
is used .
It can be specified by the fields:
subject_id;
subject_type;
resource_id;
resource_type;
resource_account_id.
Event types (event_type)
In Audit Logs, event types are grouped by services that are responsible for different parts of the products.With services, you can filter events in the log upload through the dashboard and Audit Logs API.
The list of products that support audit logs, services, and event types will continue to grow.
iam service
Responsible for operations in the account, with users, projects and accesses.Some of them (e.g. users and their keys) can be managed through the IAM API.
*
In these events, detailed information about the subject is provided in a paired authentication event.In it, events with type iam.account.init_action
are combined with the main event via the request_id
.
Service secrets
Responsible for secrets in the secrets manager. Secrets can be managed via the Secrets API.
Service certificates
Responsible for certificates in the secret manager.You can manage user certificates through the User Certificates API and Let's Encrypt® certificates through the Let's Encrypt® Certificates API.
Audit_logs service
Responsible for audit-log operations.
Service legal
Responsible for transactions with the contract customer, the paying party.
Billing service
Responsible for transactions that occur with resources when resources are deferred, unpaid, or repaid.
In billing
service events, detailed information about the subject is provided in the paired authentication event.In it, events with type iam.account.init_action
are combined with the main event via the request_id
field.
Cloud_network service
Responsible for cloud platform network operations.
Cloud_logging service
Responsible for operations in the logging platform.You can manage the logging platform through the Cloud Logging API.
Service quota_manager
Responsible for project quota operations.Quotas can be managed via Quota Management API.
Cloud_compute service
Responsible for cloud server operations.
Cloud_blockstorage service
Responsible for cloud server network disk operations.
Cloud_filestorage service
Responsible for file storage operations.
Cloud_load_balancer service
Responsible for operations with cloud load balancers.
Global_router service
Responsible for global router operations.