Configure Cloud Audit Logs And Iam Roles

What Cloud Audit Logs and Private Logs Viewer Are

Cloud Audit Logs provide visibility into actions executed across Google Cloud environments by answering "Who did what, where, and when?". Admin Activity logs capture configuration and metadata writes (ADMIN_WRITE), while System Event logs record automated actions taken by Google Cloud systems that alter resource states. Data Access audit logs capture metadata reads (ADMIN_READ), data reads (DATA_READ), and data writes (DATA_WRITE). The Private Logs Viewer (roles/logging.privateLogViewer) role provides permission to read all log types including sensitive Data Access logs in the _Default log bucket.

How it meets the requirements

• Administrative and System Modifications: Admin Activity and System Event logs are enabled by default and cannot be disabled, capturing all configuration writes and automated system adjustments without additional overhead or cost.
• Sensitive Data Interactions: Data Access audit logs are disabled by default (except for BigQuery) to prevent high-volume log ingestion costs. Explicitly enabling Data Access logs (DATA_READ and DATA_WRITE) only for services hosting sensitive data fulfills the auditing requirement while controlling storage spend.
• Auditor Access: Assigning roles/logging.privateLogViewer grants auditors access to view Admin Activity, System Event, Policy Denied, and Data Access audit logs located in the _Default bucket.

Key advantages and capabilities

• Cost Optimization: Explicitly enabling Data Access logs only where necessary prevents runaway ingestion fees from routine data operations across all services.
• Comprehensive Compliance: Captures both user-initiated operations and automated platform actions.
• Least-Privilege Security: Protects sensitive data access records by restricting them to identities holding private log inspection privileges.

Why this is optimal

This architecture accurately leverages default log generation for control plane events, targets high-volume Data Access logging selectively to optimize costs, and uses the correct IAM role needed to inspect private data logs in the default storage bucket.