Cloud Audit Logs Study Notes

Cloud Audit Logs record who did what, where, and when across Google Cloud, providing the accountability trail for security, compliance, and troubleshooting. They are part of Cloud Logging but have special types, retention, and access rules. The ACE exam tests the four log types and when each one answers an investigation question.

Key facts

• There are four audit log types: Admin Activity logs for configuration changes, Data Access logs for reading or writing user data, System Event logs for Google system actions, and Policy Denied logs.
• Admin Activity logs are always written and cannot be disabled, are retained by default at the time of writing for 400 days in the _Required bucket, and incur no logging charge for storage in that bucket.
• Data Access logs record API calls that read, create, or modify user data or metadata, can be very high volume, and are disabled by default for most services except BigQuery where they are on.
• System Event logs are generated by Google Cloud systems for actions Google takes on resources, such as live migration of VMs, and are also always written and cannot be configured off.
• Policy Denied logs are generated when a request is blocked by VPC Service Controls or certain organization policies, helping security teams diagnose legitimate work blocked by a perimeter rule.
• Enabling Data Access logs is done per service in the IAM Audit Logs configuration, and you can exempt specific principals to reduce volume from trusted automation accounts.
• Audit logs live in projects, folders, and organizations, with Admin Activity viewable in both Logs Explorer and the Activity dashboard, and access requires specific IAM roles such as Logging Private Logs Viewer for sensitive entries.
• Because Data Access logs can contain sensitive operational detail, viewing them needs the Private Logs Viewer role beyond basic logs viewing, reflecting their higher sensitivity classification.

What the exam expects you to know

• The exam asks who deleted or changed a resource, and the expected source is Admin Activity audit logs showing the principal, action, and timestamp for configuration changes.
• Expect questions on enabling Data Access logs for a service to track who read sensitive data, including the cost and volume warning that makes selective enablement important.
• You should know Admin Activity and System Event logs cannot be turned off, while Data Access logs are opt-in per service, a distinction tested directly in multiple exam forms.
• Scenarios about a request denied by VPC Service Controls point to Policy Denied logs for diagnosis rather than application logs or generic error reports.
• The exam checks retention and bucket knowledge: audit logs go to the _Required bucket with longer protected retention, unlike the shorter default retention for operational logs.
• Questions may ask which role views private audit logs, expecting Private Logs Viewer rather than a basic viewer role that cannot see Data Access entries.

Cloud Audit Logs vs Cloud Audit Logs vs Application Logs: when to use which

Use Cloud Audit Logs when the question is about the control plane and identity: who created this bucket, who changed this firewall rule, who read this dataset, and when did it happen. Use application logs when the question is about the workload itself: what the app printed, which request failed, and what stack trace was produced. Audit logs are generated by Google Cloud services about API activity and are tamper-resistant evidence; application logs are generated by your code and can contain anything you choose to write. Security and compliance scenarios almost always need audit logs. See also the Cloud Audit Logs vs Application Logs notes.

Useful gcloud commands

gcloud logging read "logName:cloudaudit.googleapis.com" --limit=20
gcloud logging read "protoPayload.methodName=\"storage.buckets.delete\"" --limit=10

Common exam traps

• Trap: Expecting Data Access logs to exist for an investigation when they were never enabled for that service. Except for a few services such as BigQuery, they are off until you turn them on.
• Trap: Trying to disable Admin Activity logs to save cost. They are always on and free to store in the required bucket; there is no supported way or exam scenario to switch them off.
• Trap: Looking for audit evidence only in the resource project. Folder and organization audit logs also exist, and activity at those levels is logged at that hierarchy node instead.
• Trap: Giving everyone Logs Viewer to investigate data access. Data Access logs need Private Logs Viewer, so a basic viewer may see an investigation page with the key entries missing.

Frequently asked questions

How do you find who deleted a VM last week?

Query Admin Activity audit logs in Logs Explorer for the Compute Engine delete method and the resource name, filtered to last week. The entry shows the authenticated principal, source IP, and timestamp. Because Admin Activity logs are always written and retained for hundreds of days by default, this evidence should still be present for a recent deletion investigation.

Why are Data Access logs not enabled everywhere by default?

They can be extremely high volume and costly on busy services, and they capture sensitive access patterns that need careful handling. Google leaves them opt-in per service, except where regulation or product design requires them, so you enable them deliberately for sensitive datasets. The exam expects you to weigh security visibility against volume and cost in your answer.

Can audit logs be exported like other logs?

Yes, audit logs in log buckets can be routed by sinks to BigQuery, Cloud Storage, or Pub/Sub for long-term retention and analysis, subject to sink filters and destination permissions. Many compliance designs export organization audit logs centrally. However, the protected copies in the _Required bucket still follow their own retention rules regardless of your export configuration.

Study aid disclaimer: Cloud Cert Notes is an independent educational study aid. It is not affiliated with, endorsed by, or sponsored by Google, Microsoft, Amazon, Oracle, or Alibaba. Google Cloud, Associate Cloud Engineer, and Cloud Digital Leader are trademarks of Google LLC; all other certification names and product names are trademarks of their respective owners. Always confirm service details against the official provider documentation before sitting an exam.