This document describes the audit logs created by Resource Manager as part of
Cloud Audit Logs.
Overview
Google Cloud services write audit logs to help you answer the questions, "Who
did what, where, and when?" within your Google Cloud resources.
Your Google Cloud projects contain only the audit logs for resources that are
directly within the Google Cloud project. Other Google Cloud resources,
such as folders, organizations, and billing accounts, contain the audit logs for
the entity itself.
For a general overview of Cloud Audit Logs, see
Cloud Audit Logs overview. For a deeper understanding
of the audit log format, see
Understand audit logs.
Available audit logs
The following types of audit logs are available for Resource Manager:
-
Admin Activity audit logs
Includes "admin write" operations that write metadata or configuration
information.
You can't disable Admin Activity audit logs.
-
Data Access audit logs
Includes "admin read" operations that read metadata or configuration
information.
Also includes "data read" and "data write" operations that
read or write user-provided data.
To receive Data Access audit logs, you must
explicitly enable them.
For fuller descriptions of the audit log types, see
Types of audit logs.
Audited operations
The following table summarizes which API operations correspond to each audit log
type in Resource Manager:
| Audit logs category |
Resource Manager operations |
| Admin Activity logs (ADMIN_WRITE) |
v3:
cloudresourcemanager.v3.organizations.setIamPolicycloudresourcemanager.v3.folders.createcloudresourcemanager.v3.folders.deletecloudresourcemanager.v3.folders.movecloudresourcemanager.v3.folders.patchcloudresourcemanager.v3.folders.setIamPolicycloudresourcemanager.v3.folders.undeletecloudresourcemanager.v3.projects.createcloudresourcemanager.v3.projects.deletecloudresourcemanager.v3.projects.movecloudresourcemanager.v3.projects.patchcloudresourcemanager.v3.projects.setIamPolicycloudresourcemanager.v3.projects.undeletecloudresourcemanager.v3.tagBindings.createcloudresourcemanager.v3.tagBindings.deletecloudresourcemanager.v3.tagKeys.createcloudresourcemanager.v3.tagKeys.deletecloudresourcemanager.v3.tagKeys.patchcloudresourcemanager.v3.tagKeys.setIamPermissionscloudresourcemanager.v3.tagValues.createcloudresourcemanager.v3.tagValues.deletecloudresourcemanager.v3.tagValues.patchcloudresourcemanager.v3.tagValues.setIamPermissions
v2beta1:
cloudresourcemanager.v2beta1.folders.createcloudresourcemanager.v2beta1.folders.deletecloudresourcemanager.v2beta1.folders.movecloudresourcemanager.v2beta1.folders.updatecloudresourcemanager.v2beta1.folders.setIamPolicycloudresourcemanager.v2beta1.folders.undelete
v2:
cloudresourcemanager.v2.folders.createcloudresourcemanager.v2.folders.deletecloudresourcemanager.v2.folders.movecloudresourcemanager.v2.folders.updatecloudresourcemanager.v2.folders.setIamPolicycloudresourcemanager.v2.folders.undelete
v1beta1:
cloudresourcemanager.v1beta1.organizations.setIamPolicycloudresourcemanager.v1beta1.organizations.updatecloudresourcemanager.v1beta1.projects.createcloudresourcemanager.v1beta1.projects.deletecloudresourcemanager.v1beta1.projects.setIamPolicycloudresourcemanager.v1beta1.projects.undeletecloudresourcemanager.v1beta1.projects.update
v1:
cloudresourcemanager.v1.folders.clearOrgPolicycloudresourcemanager.v1.folders.setOrgPolicycloudresourcemanager.v1.organizations.clearOrgPolicycloudresourcemanager.v1.organizations.setIamPolicycloudresourcemanager.v1.organizations.setOrgPolicycloudresourcemanager.v1.projects.clearOrgPolicycloudresourcemanager.v1.projects.createcloudresourcemanager.v1.projects.deletecloudresourcemanager.v1.projects.setIamPolicycloudresourcemanager.v1.projects.setOrgPolicycloudresourcemanager.v1.projects.undeletecloudresourcemanager.v1.projects.update
|
| Data Access logs (ADMIN_READ) |
v3:
cloudresourcemanager.v3.organizations.getcloudresourcemanager.v3.organizations.getIamPolicycloudresourcemanager.v3.organizations.searchcloudresourcemanager.v3.folders.getcloudresourcemanager.v3.folders.getIamPolicycloudresourcemanager.v3.folders.listcloudresourcemanager.v3.folders.searchcloudresourcemanager.v3.projects.getcloudresourcemanager.v3.projects.getIamPolicycloudresourcemanager.v3.projects.listcloudresourcemanager.v3.projects.searchcloudresourcemanager.v3.tagKeys.getcloudresourcemanager.v3.tagKeys.getIamPolicycloudresourcemanager.v3.tagKeys.listcloudresourcemanager.v3.tagValues.getcloudresourcemanager.v3.tagValues.getIamPolicycloudresourcemanager.v3.tagValues.list
v2beta1:
cloudresourcemanager.v2beta1.folders.getcloudresourcemanager.v2beta1.folders.getIamPolicycloudresourcemanager.v2beta1.folders.list
v2:
cloudresourcemanager.v2.folders.getcloudresourcemanager.v2.folders.getIamPolicycloudresourcemanager.v2.folders.list
v1beta1:
cloudresourcemanager.v1beta1.organizations.getcloudresourcemanager.v1beta1.organizations.getIamPolicycloudresourcemanager.v1beta1.projects.getcloudresourcemanager.v1beta1.projects.getIamPolicy
v1:
cloudresourcemanager.v1.folders.getEffectiveOrgPolicycloudresourcemanager.v1.folders.getOrgPolicycloudresourcemanager.v1.folders.listAvailableOrgPolicyConstraints
cloudresourcemanager.v1.folders.listOrgPoliciescloudresourcemanager.v1.organizations.getcloudresourcemanager.v1.organizations.getEffectiveOrgPolicy
cloudresourcemanager.v1.organizations.getIamPolicycloudresourcemanager.v1.organizations.getOrgPolicy
cloudresourcemanager.v1.organizations.listAvailableOrgPolicyConstraints
cloudresourcemanager.v1.organizations.listOrgPoliciescloudresourcemanager.v1.projects.getcloudresourcemanager.v1.projects.getEffectiveOrgPolicycloudresourcemanager.v1.projects.getIamPolicycloudresourcemanager.v1.projects.listAvailableOrgPolicyConstraints
cloudresourcemanager.v1.projects.listOrgPolicies
|
| Data Access logs (ADMIN_READ under integrating service name)[1] |
v3:
cloudresourcemanager.v3.tagBindings.listcloudresourcemanager.v3.effectiveTags.list |
| Data Access logs (ADMIN_READ under Organization Policy Service) |
