Cloud Access Trails
Google Cloud audit logs
Admin activity & data access
IntegraTrace collects audit logs from Google Cloud via the Cloud Logging API for visibility into admin activity, data access events, and system operations across your projects.
Data source
Cloud Audit Logs via the Cloud Logging API — Admin Activity and Data Access streams.
Events captured
Admin activity, data access events, and system events with detailed authorization information.
Required permissions
logging.logEntries.list on the Cloud Logging API.
Identity types
User accounts, service accounts, and Google-managed service accounts.
Audit log types
Admin Activity logs
Administrative actions that modify resource configuration or metadata. Always enabled and cannot be disabled.
Data Access logs
API calls that read configuration or metadata, and user-driven calls that create, modify, or read user-provided data.
System Event logs
Google Cloud system actions that modify resource configuration, generated by Google systems, not user actions.
What we track for each event
Principal
The identity that performed the action (user email or service account email).
Method & service
The GCP API method called (e.g. compute.instances.delete) and the service name.
Resource
Resource name, type, and location (project, zone, region).
Authorization
Detailed authorization info including granted permissions and policy violations.
Key use cases
Monitor IAM permission changes
Track changes to IAM policies, role bindings, and service account keys to detect unauthorized escalation.
Audit data access patterns
Identify unusual access in Cloud Storage, BigQuery, or other data services that could indicate exfiltration.
Track service account usage
Monitor service account activity to ensure workload identities behave appropriately and detect key compromise.
Detect permission denials
Analyze failed authorization attempts to find misconfigurations or reconnaissance activity.
Need to configure access? Follow the Google Cloud setup guide to grant the required permissions.