Cloud Logging uses containers called log buckets to store and organize your log data. Understanding how system-created and user-defined log buckets work helps you configure data retention, regional storage locations, encryption keys, and Identity and Access Management (IAM) access controls. For organizations and folders, you can also use organization policies and default resource settings for Cloud Logging to enforce location and encryption requirements for new log buckets.
About log buckets
Cloud Logging encrypts customer content stored at rest. Data stored in log buckets by Logging is encrypted using key-encryption keys, a process known as envelope encryption. Access to your logging data requires access to those key-encryption keys.
Log buckets are regional resources with a fixed location and are encrypted with either a customer-managed encryption key (CMEK) or a Google Cloud-powered encryption key. After a log bucket is created, you can't change its location or how its encryption key is managed. Cloud de Confiance by S3NS manages the infrastructure so that your log data is available redundantly across the zones within that region.
Your organization might have compliance, regulatory, or security requirements that govern where log buckets are located and whether they use CMEK. To enforce these requirements across an organization or folder, see Support for organizations and folders.
The retention period for the data stored in a log bucket depends on the type of
log bucket. The retention period for the _Required log bucket is fixed,
whereas you can configure custom retention for the _Default log bucket and for
user-defined log buckets.
You can create log views on a log bucket.
A log view provides access to only a subset of the log data stored in a
log bucket. For every log bucket, Cloud Logging automatically creates
the _AllLogs view that provides access to every log entry in the log bucket.
You control access to a log view by using
IAM.
To query and view your log data, use the Logs Explorer page. This page helps you troubleshoot and analyze the performance of your services and applications. You can view individual log entries and filter your log data. This interface has a scope setting, which lets you search for log data by project, log bucket, or log view.
To learn more, see Query and view log entries.
System-created log buckets
When the system creates a Cloud de Confiance project, billing account, folder, or
organization, Logging creates two log buckets, one named
_Required and the other named _Default:
Location: Cloud Logging selects the location of these buckets unless default resource settings for Cloud Logging are configured. You can't change the location after the buckets are created.
Encryption: These buckets use Google Cloud-powered encryption keys unless default resource settings for Cloud Logging specify a CMEK. You can't change this configuration after the buckets are created.
You can't delete the system-created log buckets.
_Required log bucket
The _Required log bucket stores log entries that are required for compliance
or auditing purposes. For this reason, you can't delete this log bucket, and you
can't modify which log entries are stored in this log bucket.
Log entries in this log bucket are retained for
400 days; you can't change this retention period.
The log entries that are stored in the _Required log bucket for a resource
also originate in that resource. That is, the _Required log bucket in
a Cloud de Confiance project can only store log entries that originate in that
project.
The _Required log bucket stores the following types of log entries:
- Admin Activity audit logs
- System Event audit logs
- Google Workspace Admin Audit logs
- Enterprise Groups Audit logs
- Login Audit logs
_Default log bucket
The _Default log bucket stores log entries that aren't automatically
stored in the _Required log bucket. Because the _Default log bucket is
system created, you can't delete it. However, you can
modify which log entries are stored in this log bucket.
Cloud Logging retains the log entries in the _Default bucket for
30 days, unless you
configure custom retention for the
bucket.
For example, this log bucket stores the following types of log entries:
- Data Access audit logs
- Policy Denied audit logs
- Logs generated by applications and Cloud de Confiance by S3NS services
User-defined log buckets
You can create user-defined log buckets in any Cloud de Confiance project. When you create a user-defined log bucket, you select the location and set the data retention period. You have the option to provide a CMEK.
You can modify and delete user-defined log buckets. To protect against deleting a log bucket that stores log entries that are within their retention period, you can lock the log bucket against updates.
Support for organizations and folders
To help your organization meet compliance and regulatory needs, Logging supports both default resource settings and organization policies:
Default resource settings: For organizations and folders, default resource settings for Cloud Logging control the location of new system-created log buckets. They also let you specify a CMEK, which applies to both new system-created and user-defined log buckets.
Organization policies: An organization policy can restrict the location of new user-defined log buckets. Logging supports organization policies that specify regions where log buckets can, or can't, be created.
Control access to a log bucket
IAM permissions and roles control access to log data. For example, you can do all of the following:
- Grant read and edit access to a log bucket.
- Grant edit access to a log bucket based on group membership by using tags.
- Control access to specific fields in a log entry by configuring field-level access on a log bucket.
Grant access to a subset of log entries in a log bucket by creating a log view on that log bucket.
Every log bucket has a default log view, which typically includes every log entry in the log bucket. For the
_Defaultlog bucket, the default log view excludes Data Access audit log entries.
To give a user the permissions they need to view and analyze log entries, you typically grant one of the following IAM roles:
Logs Viewer (
roles/logging.viewer) role: Grants access to all log entries in the_Requiredbucket and access to the default log view on the_Defaultbucket.Private Logs Viewer (
roles/logging.privateLogViewer) role: Grants access to all logs in the_Requiredand_Defaultbuckets, including Data Access audit logs.
If you create user-defined log buckets or log views on log buckets, then additional permissions are required. For more information about roles, see Access control with IAM.
List of supported regions
Log buckets are regional resources. The infrastructure that stores,
indexes, and searches your log entries is located in a specific geographical
location. With the exception of log buckets in the global, eu, or us
regions, Cloud de Confiance by S3NS manages the infrastructure so that your log data is
available redundantly across the zones within the region of the log bucket.
The following regions are supported by Cloud Logging:
| Region name | Region description |
|---|---|
u-france-east1 |
France |
global |
Logs stored in any data centers that are in any supported region. Logs might be moved to different data centers. No additional redundancy guarantees. If you want to choose the storage location for your log data, then use a regional log bucket. |