Understanding and using Access Transparency logs

This page describes the contents of Access Transparency log entries and how to view and use them.

Access Transparency logs in detail

Access Transparency logs can be integrated with your existing security information and event management (SIEM) tools to automate your audits of S3NS personnel when they access your content. Access Transparency logs are available in the Cloud de Confiance console alongside your Cloud Audit Logs.

Access Transparency log entries include the following types of details:

• The affected resource and action.
• The time of the action.
• The reasons for the action (for example, the case number associated with a customer support request).
• Data about who is acting on the content (for example, the S3NS personnel's location).

Enabling Access Transparency

For information about enabling Access Transparency for your Cloud de Confiance by S3NS organization, see Enabling Access Transparency.

Viewing Access Transparency logs

After you've configured Access Transparency for your Cloud de Confiance organization, you can set controls for who can access the Access Transparency logs by assigning a user or group the Private Logs Viewer role.

Sample Access Transparency log entry

The following is an example of an Access Transparency log entry:

{
 insertId:  "abcdefg12345"
 jsonPayload: {
  @type:  "type.googleapis.com/google.cloud.audit.TransparencyLog"
  location: {
   principalOfficeCountry:  "US"
   principalEmployingEntity:  "Google LLC"
   principalPhysicalLocationCountry:  "CA"
  }
  principalJobTitle: "Engineering"
  product: [
   0:  "Cloud Storage"
  ]
  reason: [
    detail:  "Case number: bar123"
    type:  "CUSTOMER_INITIATED_SUPPORT"
  ]
  permissionDetails:[
    0: {
     permissionType: "DATA_READ"
     logAccessed: true
   }
   1: {
     permissionType: "ADMIN_READ"
    }
  ]
  eventId: "asdfg12345asdfg12345asdfg12345"
  accesses: [
   0: {
    methodName: "GoogleInternal.Read"
    resourceName: "//googleapis.com/storage/buckets/BUCKET_NAME/objects/foo123"
    }
  ]
  accessApprovals: [
   0: "projects/123/approvalRequests/abcdef12345"
  ]
 }
 logName:  "projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Faccess_transparency"
 operation: {
  id:  "12345xyz"
 }
 receiveTimestamp:  "2017-12-18T16:06:37.400577736Z"
 resource: {
  labels: {
   project_id:  "1234567890"
  }
  type:  "project"
 }
 severity:  "NOTICE"
 timestamp:  "2017-12-18T16:06:24.660001Z"
}

Log field descriptions

Values for permissionDetails fields

The following permission details are available in Access Transparency logs:

• permissionType: Indicates the Identity and Access Management (IAM) Permission type associated with the data access by the S3NS administrator. For example, permission types for each public API method for Cloud SQL can be found in the SQL documentation. Permission types indicate the maximum permission present, even if an access would have been possible with a lesser permission type.

• logAccessed: This field indicates if an administrator or data read access permission is limited to log accesses. For example a data_read access to Observability Analytics logs is accompanied by "logAccessed = true", indicating that the data_read permission is limited to log data. This field is omitted if the access is not a log.

Values for accesses:methodNames field

The following methods can appear in the accesses:methodNames field in Access Transparency logs:

• Standard methods: These methods are List, Get, Create, Update, and Delete. For more information, see Standard methods.
• Custom methods: Custom methods refer to API methods besides the 5 standard methods. Common custom methods include Cancel, BatchGet, Move, Search, and Undelete. For more information, see Custom methods.
• GoogleInternal methods: The following are examples of GoogleInternal methods that appear in the accesses:methodNames field:

The GoogleInternal accesses are strictly restricted to authorized personnel for justified and auditable access. The presence of a method doesn't indicate availability to all roles.

Justification reason codes

Monitoring Access Transparency logs

You can monitor Access Transparency logs by using the Cloud Monitoring API. To get started, see the Monitoring documentation.

You can set up a logs-based metric and then set up an alerting policy to give you timely awareness of issues surfaced by these logs. For example, you can create a logs-based metric that captures S3NS personnel accesses of your content and then create an alerting policy in Monitoring that lets you know if the number of accesses in a given period exceeds a specified threshold.