> For the complete documentation index, see [llms.txt](https://docs.expel.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.expel.io/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench/google-cloud-platform-enable-data-access-log-support.md).

# Google Cloud Platform: Enable Data Access Log Support

Data Access audit logs generate log events from the resource interaction plane of Google Cloud Platform. This includes event logging of requests to Google Cloud Platform resources such as object read/write operations, to answer questions such as “Who accessed file data in a storage bucket?” Expel doesn't offer monitoring and detection support for Data Access audit logs; however, Expel can use these logs to support alert triage and investigations.

To generate these logs, Google Cloud Platform customers must enable them. Review Google’s pricing reference for more information.

{% hint style="warning" %}
These logs can be long, especially if resources are being accessed by the public or other high-volume situations. Make sure you thoroughly understand the cost impact before enabling Data Access audit logs.
{% endhint %}

## Prerequisites <a href="#h_01hye6j5pvw51tgjfnjq00a5a1" id="h_01hye6j5pvw51tgjfnjq00a5a1"></a>

1. You must have completed [Google Cloud Platform setup for Workbench](/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench.md).
2. You must have the Google Cloud CLI installed.

## Step 1: Configure BigQuery <a href="#h_01hye6j5pvpyhm415m5k8j3w03" id="h_01hye6j5pvpyhm415m5k8j3w03"></a>

1. Navigate to BigQuery in the **expel-integration** project and create a new dataset.
   * **Dataset ID** - expel\_integration\_dataset
   * **Data location** - Default
   * **Default Table Expiration** - 30 days
   * **Encryption** - Google-managed key
2. From the dataset settings, click **SHARE DATASET**, and grant the `expel-gcp-integration` service account (created in [Step 3 of the Google Cloud Platform guide](/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench.md#h_01hh480wh2bzapx76wjx5jj6zp)) the **BigQuery Data Viewer** and **BigQuery User** roles.

## Step 2: Create the BigQuery Organization Log Sink <a href="#h_01hye6j5pv44aac3dhrzma0se8" id="h_01hye6j5pv44aac3dhrzma0se8"></a>

1. Log in to Google Cloud Platform.

   ```
   $ gcloud auth login
   ```
2. List the organizations and **take note of the org ID**.

   ```
   $ gcloud organizations list
   ```
3. Create the BigQuery organization log sink:

   * If your organization plans to use Event Threat Detection service, use this command:

     ```
     $ gcloud logging sinks create expel-org-sink-bigquery bigquery.
      googleapis.com/projects/[project-id]
     /datasets/expel_integration_ dataset --include-children
     --organization=[org-id] --log
     filter="logName=~\"cloudaudit\.googleapis\.com\%2Fdata_access\"
     OR  resource.type=\"threat_detector\""
     ```
   * If your organization does **not** plan to use the Event Threat Detection service, use this command:

     ```
     $ gcloud logging sinks create expel-org-sink-bigquery bigquery.
     googleapis.com/projects/[project-id]
     /datasets/expel_integration_ dataset --include-children
     --organization=[org-id] --log
     filter="logName=~\"cloudaudit\.googleapis\.com\%2Fdata_access\""
     ```

   This automatically creates a new service account which must be granted **BigQuery Data Editor** in the **expel\_integration\_dataset** in the console.

## Step 3: Enable Data Access Logs <a href="#h_01hye6j5pvdcdzr28st64dxneg" id="h_01hye6j5pvdcdzr28st64dxneg"></a>

Admin Activity audit logs are enabled by default in Google Cloud Platform. During your initial onboarding, your organization was configured to send Admin Activity audit logs and Event Threat Detection alerts to Expel for monitoring and security detection support. Data Access audit logs are not enabled by default in Google Cloud Platform and have a cost to do so.

**Reference:**

* [Google Cloud: Understanding Audit Logs](https://docs.cloud.google.com/logging/docs/audit/understanding-audit-logs)
* [Google Cloud: Enable Data Access audit logs](https://docs.cloud.google.com/logging/docs/audit/configure-data-access)

### Default Configuration Option <a href="#h_01hye6j5pwndr8x34s14hr3xm3" id="h_01hye6j5pwndr8x34s14hr3xm3"></a>

A default audit log configuration can be set at the organization IAM so all new folders and projects inherit the configuration. This saves you from administrative hassle down the road.

### Cost-Conscious Option <a href="#h_01jdjm5jm5s9scjqjm3bs3km83" id="h_01jdjm5jm5s9scjqjm3bs3km83"></a>

If you only want to collect Data Access audit logs from projects with particularly sensitive data or perhaps just production projects, you can configure audit logs in any IAM and IAM inheritance applies configuration as necessary. For example, if your organization has a production project with sensitive client data stored in Cloud Storage, you can consider only enabling the Google Cloud Storage Data Access audit logs in that particular project and leave it turned off in all of the other projects.

### Enabling the Logs by Service <a href="#h_01jdjm5ya4m7tx7g04g4kg2dny" id="h_01jdjm5ya4m7tx7g04g4kg2dny"></a>

1. From the IAM console, click **Audit Logs**. Each service API can be enabled or disabled from this table. Some of the services to consider enabling:
   * Cloud Billing API
   * Cloud Build API
   * Cloud Functions API
   * Cloud Key Management Service (KMS) API
   * Cloud Logging API
   * Cloud Memorystore for Redis API
   * Cloud Pub/Sub API
   * Cloud Resource Manager API
   * Cloud SQL
   * Compute Engine API
   * Google App Engine Admin API
   * Google Cloud Deployment Manager V2 API
   * Google Cloud Storage
   * Identity and Access Management (IAM) API
   * Secret Manager API

{% hint style="info" %}
Some services are prone to generate large volumes of log data (for example, Kubernetes, Compute Engine API and Google Cloud Storage), which can significantly affect cost.
{% endhint %}

2. Select your audit logging preference, and click **Save**.

As new projects are created and services are enabled by users, audit logging configuration should be inherited in IAM appropriately and data is recorded to your BigQuery table.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.expel.io/connect-your-technology/d-j-integrations/google/google-cloud-platform-setup-for-workbench/google-cloud-platform-enable-data-access-log-support.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.