/cloud-logging-query-generation

Cloud Storage (GCS) LQL queries

Base schema and structural patterns

Google Cloud Storage (GCS) telemetry is entirely driven by Cloud Audit Logs. GCS utilizes Audit Logs to track everything from bucket provisioning (administrative) to file downloads (data access).

Core resource type

• Buckets (gcs_bucket): All GCS logs are bound to the bucket resource type. Filter explicitly using resource.labels.bucket_name="<BUCKET_NAME>" to scope queries to a specific bucket.

Audit log routing

GCS logs split cleanly along the standard Cloud Audit Log paradigm:

• Admin Activity: Use log_id("cloudaudit.googleapis.com/activity") to query control-plane mutations. This captures administrative operations like storage.buckets.create, storage.buckets.delete, and IAM policy modifications.
• Data Access: Use log_id("cloudaudit.googleapis.com/data_access") to query object-level file interactions, like file uploads (storage.objects.create) or file reads (storage.objects.get).

Operation targeting

• Combine resource isolation with protoPayload.methodName (for example: protoPayload.methodName="storage.objects.delete") to locate precise user or system actions.

Example queries

All audit logs for GCS buckets

Variables to replace: None

resource.type="gcs_bucket" AND
logName:"cloudaudit.googleapis.com"

GCS bucket deletion logs

Variables to replace: None

resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="storage.buckets.delete"

GCS bucket logs

Variables to replace: <BUCKET_NAME>

resource.type="gcs_bucket" AND
resource.labels.bucket_name="<BUCKET_NAME>"

GCS bucket creation logs

Variables to replace: None

resource.type="gcs_bucket" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="storage.buckets.create"