[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6P3WFD2AH2JZB07YP5CX3X9":3,"skill-same:01M6P3WFD2AH2JZB07YP5CX3X9":78},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":15,"categories":16,"keywords":17,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":26,"commitSha":53,"skillDirectory":54,"forksCount":13,"repositoryHtmlUrl":55,"repositoryHomepageUrl":6,"ownerHtmlUrl":56,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":57,"install":58,"resources":71},"01M6P3WFD2AH2JZB07YP5CX3X9","gcp-audit-logs",null,"Configure GCP Cloud Audit Logs for compliance. Set up log routing and BigQuery analysis. Use when auditing GCP activity.","duc-duy-1612\u002FOnline-Delivery-Systems-Web","duc-duy-1612","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F192231384?v=4","01M6NSDKQQDKVTHZ8DZMZ1VYY6","01M6NSDKW8DDVTQHBT1HBDDJPT",0,"MIT","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fgcp-audit-logs\u002FSKILL.md",[],[18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37],"audit","logs","gcp","gcp audit logs","use","apply","for","controls","main","community","log","agent-skills","up","change","configure","analysis","devops-security","SET","license","routing","2026-11-10 10:12:30",false,"---\nname: gcp-audit-logs\ndescription: Configure GCP Cloud Audit Logs for compliance. Set up log routing and\n  BigQuery analysis. Use when auditing GCP activity.\ncategory: security\nrisk: safe\nsource: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\nsource_repo: BagelHole\u002FDevOps-Security-Agent-Skills\nsource_type: community\ndate_added: '2026-09-20'\nlicense: MIT\nlicense_source: https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE\ncompatibility: Checklist and framework guidance; no privileged tooling required. Apply\n  controls through your own change process.\nmetadata:\n  author: devops-skills\n  version: '1.0'\n---\n\n# GCP Audit Logs\n\nAudit GCP activity with Cloud Audit Logs for compliance, security investigation, and operational monitoring.\n\n## Audit Log Types\n\n```yaml\nlog_types:\n  admin_activity:\n    description: API calls that modify resource configuration or metadata\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n    examples:\n      - Creating or deleting VM instances\n      - Changing IAM policies\n      - Modifying firewall rules\n\n  data_access:\n    description: API calls that read resource configuration, metadata, or user data\n    enabled: Must be explicitly enabled (except BigQuery)\n    retention: 30 days (default)\n    cost: Can be significant at high volume\n    subtypes:\n      ADMIN_READ: Read resource configuration\u002Fmetadata\n      DATA_READ: Read user-provided data\n      DATA_WRITE: Write user-provided data\n\n  system_event:\n    description: Actions performed by GCP systems on behalf of resources\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n    examples:\n      - Live migration of VM instances\n      - Automatic scaling events\n\n  policy_denied:\n    description: Actions denied by VPC Service Controls or organization policies\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n```\n\n## Enable Data Access Logs for an Organization\n\n```bash\n# Get current org IAM policy\ngcloud organizations get-iam-policy ORG_ID --format=json > org-policy.json\n\n# Add audit config to org-policy.json:\n# {\n#   \"auditConfigs\": [\n#     {\n#       \"service\": \"allServices\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"ADMIN_READ\"},\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     }\n#   ],\n#   ...existing bindings...\n# }\n\n# Apply the updated policy\ngcloud organizations set-iam-policy ORG_ID org-policy.json\n\n# Enable data access logs for specific services at project level\ngcloud projects get-iam-policy PROJECT_ID --format=json > project-policy.json\n\n# Example: enable only for Cloud Storage and BigQuery\n# {\n#   \"auditConfigs\": [\n#     {\n#       \"service\": \"storage.googleapis.com\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     },\n#     {\n#       \"service\": \"bigquery.googleapis.com\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     }\n#   ]\n# }\n\ngcloud projects set-iam-policy PROJECT_ID project-policy.json\n```\n\n## Configure Log Sinks for Export\n\n```bash\n# Create BigQuery dataset for audit log export\nbq mk --dataset \\\n  --description \"Audit log export\" \\\n  --default_table_expiration 0 \\\n  --location US \\\n  PROJECT_ID:audit_logs\n\n# Create organization-level log sink to BigQuery\ngcloud logging sinks create org-audit-bigquery \\\n  bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Faudit_logs \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\"'\n\n# Get the sink writer identity and grant BigQuery access\nSINK_SA=$(gcloud logging sinks describe org-audit-bigquery \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\nbq add-iam-policy-binding \\\n  --member=\"$SINK_SA\" \\\n  --role=\"roles\u002Fbigquery.dataEditor\" \\\n  PROJECT_ID:audit_logs\n\n# Create Cloud Storage sink for long-term archive\ngsutil mb -l US -b on gs:\u002F\u002Forg-audit-logs-archive\ngsutil retention set 7y gs:\u002F\u002Forg-audit-logs-archive\n\ngcloud logging sinks create org-audit-storage \\\n  storage.googleapis.com\u002Forg-audit-logs-archive \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\"'\n\nSTORAGE_SA=$(gcloud logging sinks describe org-audit-storage \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\ngsutil iam ch \"$STORAGE_SA:objectCreator\" gs:\u002F\u002Forg-audit-logs-archive\n\n# Create Pub\u002FSub sink for real-time streaming to SIEM\ngcloud pubsub topics create audit-log-stream\n\ngcloud logging sinks create org-audit-pubsub \\\n  pubsub.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Ftopics\u002Faudit-log-stream \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\" AND (protoPayload.methodName:\"delete\" OR protoPayload.methodName:\"setIamPolicy\" OR severity>=WARNING)'\n\nPUBSUB_SA=$(gcloud logging sinks describe org-audit-pubsub \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\ngcloud pubsub topics add-iam-policy-binding audit-log-stream \\\n  --member=\"$PUBSUB_SA\" \\\n  --role=\"roles\u002Fpubsub.publisher\"\n```\n\n## Logging Queries (Cloud Logging Explorer)\n\n```bash\n# View admin activity logs for the last 24 hours\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND timestamp>=\"2024-01-01T00:00:00Z\"' \\\n  --project=PROJECT_ID \\\n  --format=json \\\n  --limit=100\n\n# Find IAM policy changes\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND protoPayload.methodName=\"SetIamPolicy\"' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n\n# Find resource deletions\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND protoPayload.methodName=~\"delete\"\n  AND severity>=NOTICE' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n\n# Data access audit log entries\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Fdata_access\"\n  AND protoPayload.serviceName=\"storage.googleapis.com\"\n  AND protoPayload.methodName=\"storage.objects.get\"' \\\n  --project=PROJECT_ID \\\n  --freshness=24h\n\n# Failed authorization attempts\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Fpolicy\"' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n```\n\n## BigQuery Analysis Queries\n\n```sql\n-- All destructive operations in the last 30 days\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  protopayload_auditlog.methodName AS method,\n  protopayload_auditlog.resourceName AS resource,\n  resource.labels.project_id AS project,\n  protopayload_auditlog.status.code AS status_code,\n  protopayload_auditlog.status.message AS status_message\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY))\n  AND protopayload_auditlog.methodName LIKE '%delete%'\nORDER BY timestamp DESC\nLIMIT 500;\n\n-- IAM policy changes across the organization\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS changed_by,\n  resource.labels.project_id AS project,\n  protopayload_auditlog.resourceName AS resource,\n  protopayload_auditlog.servicedata_v1_iam.policyDelta.bindingDeltas\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY))\n  AND protopayload_auditlog.methodName = 'SetIamPolicy'\nORDER BY timestamp DESC;\n\n-- Activity per principal (detect anomalous usage)\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  COUNT(*) AS action_count,\n  COUNT(DISTINCT protopayload_auditlog.methodName) AS unique_methods,\n  COUNT(DISTINCT protopayload_auditlog.requestMetadata.callerIp) AS unique_ips,\n  MIN(timestamp) AS first_activity,\n  MAX(timestamp) AS last_activity\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\nGROUP BY principal\nORDER BY action_count DESC\nLIMIT 50;\n\n-- Service account key creation events (security risk indicator)\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS created_by,\n  protopayload_auditlog.resourceName AS service_account,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 90 DAY))\n  AND protopayload_auditlog.methodName = 'google.iam.admin.v1.CreateServiceAccountKey'\nORDER BY timestamp DESC;\n\n-- Data access patterns for sensitive Cloud Storage buckets\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS accessor,\n  protopayload_auditlog.resourceName AS object_path,\n  protopayload_auditlog.methodName AS access_type,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_data_access_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\n  AND protopayload_auditlog.resourceName LIKE '%sensitive-bucket%'\nORDER BY timestamp DESC\nLIMIT 1000;\n\n-- Failed operations indicating permission issues\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  protopayload_auditlog.methodName AS method,\n  protopayload_auditlog.status.code AS error_code,\n  protopayload_auditlog.status.message AS error_message,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\n  AND protopayload_auditlog.status.code != 0\nORDER BY timestamp DESC\nLIMIT 500;\n```\n\n## Alerting Policies\n\n```bash\n# Alert on service account key creation\ngcloud alpha monitoring policies create \\\n  --display-name=\"SA Key Created\" \\\n  --condition-display-name=\"Service Account Key Creation\" \\\n  --condition-filter='resource.type=\"audited_resource\" AND protoPayload.methodName=\"google.iam.admin.v1.CreateServiceAccountKey\"' \\\n  --condition-threshold-value=0 \\\n  --condition-threshold-comparison=COMPARISON_GT \\\n  --condition-threshold-duration=0s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID \\\n  --combiner=OR\n\n# Create a log-based metric for IAM changes\ngcloud logging metrics create iam-policy-changes \\\n  --description=\"Count of IAM policy changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\" AND protoPayload.methodName=\"SetIamPolicy\"'\n\n# Create alerting policy using the log-based metric\ngcloud alpha monitoring policies create \\\n  --display-name=\"IAM Policy Changes\" \\\n  --condition-display-name=\"IAM Changes Detected\" \\\n  --condition-filter='metric.type=\"logging.googleapis.com\u002Fuser\u002Fiam-policy-changes\"' \\\n  --condition-threshold-value=0 \\\n  --condition-threshold-comparison=COMPARISON_GT \\\n  --condition-threshold-duration=0s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n\n# Create log-based metric for firewall changes\ngcloud logging metrics create firewall-rule-changes \\\n  --description=\"Count of firewall rule changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\"\n    AND (protoPayload.methodName=\"v1.compute.firewalls.insert\"\n    OR protoPayload.methodName=\"v1.compute.firewalls.delete\"\n    OR protoPayload.methodName=\"v1.compute.firewalls.patch\")'\n\n# Create log-based metric for VPC network changes\ngcloud logging metrics create vpc-network-changes \\\n  --description=\"Count of VPC network changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\"\n    AND resource.type=\"gce_network\"\n    AND (protoPayload.methodName=~\"insert$\" OR protoPayload.methodName=~\"delete$\")'\n```\n\n## Terraform Configuration\n\n```hcl\n# Organization-level audit log sink to BigQuery\nresource \"google_logging_organization_sink\" \"audit_bigquery\" {\n  name             = \"org-audit-bigquery\"\n  org_id           = var.org_id\n  destination      = \"bigquery.googleapis.com\u002Fprojects\u002F${var.project_id}\u002Fdatasets\u002F${google_bigquery_dataset.audit_logs.dataset_id}\"\n  filter           = \"logName:\\\"cloudaudit.googleapis.com\\\"\"\n  include_children = true\n\n  bigquery_options {\n    use_partitioned_tables = true\n  }\n}\n\nresource \"google_bigquery_dataset\" \"audit_logs\" {\n  dataset_id    = \"audit_logs\"\n  project       = var.project_id\n  location      = \"US\"\n  description   = \"Organization audit log export\"\n\n  default_table_expiration_ms = null  # No auto-expiry\n\n  access {\n    role          = \"WRITER\"\n    user_by_email = google_logging_organization_sink.audit_bigquery.writer_identity\n  }\n\n  access {\n    role          = \"READER\"\n    group_by_email = \"security-auditors@example.com\"\n  }\n}\n\n# Retention bucket with bucket lock\nresource \"google_storage_bucket\" \"audit_archive\" {\n  name          = \"org-audit-logs-archive\"\n  location      = \"US\"\n  force_destroy = false\n  project       = var.project_id\n\n  uniform_bucket_level_access = true\n\n  retention_policy {\n    is_locked        = true\n    retention_period = 220752000  # 7 years in seconds\n  }\n\n  lifecycle_rule {\n    condition {\n      age = 90\n    }\n    action {\n      type          = \"SetStorageClass\"\n      storage_class = \"COLDLINE\"\n    }\n  }\n}\n\n# Log-based alerting\nresource \"google_logging_metric\" \"iam_changes\" {\n  name    = \"iam-policy-changes\"\n  project = var.project_id\n  filter  = \"logName:\\\"cloudaudit.googleapis.com\u002Factivity\\\" AND protoPayload.methodName=\\\"SetIamPolicy\\\"\"\n\n  metric_descriptor {\n    metric_kind = \"DELTA\"\n    value_type  = \"INT64\"\n  }\n}\n\nresource \"google_monitoring_alert_policy\" \"iam_changes\" {\n  display_name = \"IAM Policy Changes Detected\"\n  project      = var.project_id\n  combiner     = \"OR\"\n\n  conditions {\n    display_name = \"IAM policy change count\"\n    condition_threshold {\n      filter          = \"metric.type=\\\"logging.googleapis.com\u002Fuser\u002Fiam-policy-changes\\\" AND resource.type=\\\"global\\\"\"\n      comparison      = \"COMPARISON_GT\"\n      threshold_value = 0\n      duration        = \"0s\"\n    }\n  }\n\n  notification_channels = [var.notification_channel_id]\n}\n```\n\n\n## Contents\n\n- [Setup Checklist](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Enabling organization-wide audit logging across GCP projects\n- Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP\n- Investigating unauthorized access or suspicious API activity\n- Setting up alerting on administrative and data access events\n- Exporting logs to BigQuery for long-term analysis and reporting\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n","# GCP Audit Logs\n\nAudit GCP activity with Cloud Audit Logs for compliance, security investigation, and operational monitoring.\n\n## Audit Log Types\n\n```yaml\nlog_types:\n  admin_activity:\n    description: API calls that modify resource configuration or metadata\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n    examples:\n      - Creating or deleting VM instances\n      - Changing IAM policies\n      - Modifying firewall rules\n\n  data_access:\n    description: API calls that read resource configuration, metadata, or user data\n    enabled: Must be explicitly enabled (except BigQuery)\n    retention: 30 days (default)\n    cost: Can be significant at high volume\n    subtypes:\n      ADMIN_READ: Read resource configuration\u002Fmetadata\n      DATA_READ: Read user-provided data\n      DATA_WRITE: Write user-provided data\n\n  system_event:\n    description: Actions performed by GCP systems on behalf of resources\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n    examples:\n      - Live migration of VM instances\n      - Automatic scaling events\n\n  policy_denied:\n    description: Actions denied by VPC Service Controls or organization policies\n    enabled: Always (cannot be disabled)\n    retention: 400 days (default)\n    cost: No charge\n```\n\n## Enable Data Access Logs for an Organization\n\n```bash\n# Get current org IAM policy\ngcloud organizations get-iam-policy ORG_ID --format=json > org-policy.json\n\n# Add audit config to org-policy.json:\n# {\n#   \"auditConfigs\": [\n#     {\n#       \"service\": \"allServices\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"ADMIN_READ\"},\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     }\n#   ],\n#   ...existing bindings...\n# }\n\n# Apply the updated policy\ngcloud organizations set-iam-policy ORG_ID org-policy.json\n\n# Enable data access logs for specific services at project level\ngcloud projects get-iam-policy PROJECT_ID --format=json > project-policy.json\n\n# Example: enable only for Cloud Storage and BigQuery\n# {\n#   \"auditConfigs\": [\n#     {\n#       \"service\": \"storage.googleapis.com\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     },\n#     {\n#       \"service\": \"bigquery.googleapis.com\",\n#       \"auditLogConfigs\": [\n#         {\"logType\": \"DATA_READ\"},\n#         {\"logType\": \"DATA_WRITE\"}\n#       ]\n#     }\n#   ]\n# }\n\ngcloud projects set-iam-policy PROJECT_ID project-policy.json\n```\n\n## Configure Log Sinks for Export\n\n```bash\n# Create BigQuery dataset for audit log export\nbq mk --dataset \\\n  --description \"Audit log export\" \\\n  --default_table_expiration 0 \\\n  --location US \\\n  PROJECT_ID:audit_logs\n\n# Create organization-level log sink to BigQuery\ngcloud logging sinks create org-audit-bigquery \\\n  bigquery.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Fdatasets\u002Faudit_logs \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\"'\n\n# Get the sink writer identity and grant BigQuery access\nSINK_SA=$(gcloud logging sinks describe org-audit-bigquery \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\nbq add-iam-policy-binding \\\n  --member=\"$SINK_SA\" \\\n  --role=\"roles\u002Fbigquery.dataEditor\" \\\n  PROJECT_ID:audit_logs\n\n# Create Cloud Storage sink for long-term archive\ngsutil mb -l US -b on gs:\u002F\u002Forg-audit-logs-archive\ngsutil retention set 7y gs:\u002F\u002Forg-audit-logs-archive\n\ngcloud logging sinks create org-audit-storage \\\n  storage.googleapis.com\u002Forg-audit-logs-archive \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\"'\n\nSTORAGE_SA=$(gcloud logging sinks describe org-audit-storage \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\ngsutil iam ch \"$STORAGE_SA:objectCreator\" gs:\u002F\u002Forg-audit-logs-archive\n\n# Create Pub\u002FSub sink for real-time streaming to SIEM\ngcloud pubsub topics create audit-log-stream\n\ngcloud logging sinks create org-audit-pubsub \\\n  pubsub.googleapis.com\u002Fprojects\u002FPROJECT_ID\u002Ftopics\u002Faudit-log-stream \\\n  --organization=ORG_ID \\\n  --include-children \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\" AND (protoPayload.methodName:\"delete\" OR protoPayload.methodName:\"setIamPolicy\" OR severity>=WARNING)'\n\nPUBSUB_SA=$(gcloud logging sinks describe org-audit-pubsub \\\n  --organization=ORG_ID --format='value(writerIdentity)')\n\ngcloud pubsub topics add-iam-policy-binding audit-log-stream \\\n  --member=\"$PUBSUB_SA\" \\\n  --role=\"roles\u002Fpubsub.publisher\"\n```\n\n## Logging Queries (Cloud Logging Explorer)\n\n```bash\n# View admin activity logs for the last 24 hours\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND timestamp>=\"2024-01-01T00:00:00Z\"' \\\n  --project=PROJECT_ID \\\n  --format=json \\\n  --limit=100\n\n# Find IAM policy changes\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND protoPayload.methodName=\"SetIamPolicy\"' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n\n# Find resource deletions\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Factivity\"\n  AND protoPayload.methodName=~\"delete\"\n  AND severity>=NOTICE' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n\n# Data access audit log entries\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Fdata_access\"\n  AND protoPayload.serviceName=\"storage.googleapis.com\"\n  AND protoPayload.methodName=\"storage.objects.get\"' \\\n  --project=PROJECT_ID \\\n  --freshness=24h\n\n# Failed authorization attempts\ngcloud logging read 'logName:\"cloudaudit.googleapis.com\u002Fpolicy\"' \\\n  --project=PROJECT_ID \\\n  --freshness=7d\n```\n\n## BigQuery Analysis Queries\n\n```sql\n-- All destructive operations in the last 30 days\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  protopayload_auditlog.methodName AS method,\n  protopayload_auditlog.resourceName AS resource,\n  resource.labels.project_id AS project,\n  protopayload_auditlog.status.code AS status_code,\n  protopayload_auditlog.status.message AS status_message\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY))\n  AND protopayload_auditlog.methodName LIKE '%delete%'\nORDER BY timestamp DESC\nLIMIT 500;\n\n-- IAM policy changes across the organization\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS changed_by,\n  resource.labels.project_id AS project,\n  protopayload_auditlog.resourceName AS resource,\n  protopayload_auditlog.servicedata_v1_iam.policyDelta.bindingDeltas\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 30 DAY))\n  AND protopayload_auditlog.methodName = 'SetIamPolicy'\nORDER BY timestamp DESC;\n\n-- Activity per principal (detect anomalous usage)\nSELECT\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  COUNT(*) AS action_count,\n  COUNT(DISTINCT protopayload_auditlog.methodName) AS unique_methods,\n  COUNT(DISTINCT protopayload_auditlog.requestMetadata.callerIp) AS unique_ips,\n  MIN(timestamp) AS first_activity,\n  MAX(timestamp) AS last_activity\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\nGROUP BY principal\nORDER BY action_count DESC\nLIMIT 50;\n\n-- Service account key creation events (security risk indicator)\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS created_by,\n  protopayload_auditlog.resourceName AS service_account,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 90 DAY))\n  AND protopayload_auditlog.methodName = 'google.iam.admin.v1.CreateServiceAccountKey'\nORDER BY timestamp DESC;\n\n-- Data access patterns for sensitive Cloud Storage buckets\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS accessor,\n  protopayload_auditlog.resourceName AS object_path,\n  protopayload_auditlog.methodName AS access_type,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_data_access_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\n  AND protopayload_auditlog.resourceName LIKE '%sensitive-bucket%'\nORDER BY timestamp DESC\nLIMIT 1000;\n\n-- Failed operations indicating permission issues\nSELECT\n  timestamp,\n  protopayload_auditlog.authenticationInfo.principalEmail AS principal,\n  protopayload_auditlog.methodName AS method,\n  protopayload_auditlog.status.code AS error_code,\n  protopayload_auditlog.status.message AS error_message,\n  protopayload_auditlog.requestMetadata.callerIp AS source_ip\nFROM `project.audit_logs.cloudaudit_googleapis_com_activity_*`\nWHERE _TABLE_SUFFIX >= FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 7 DAY))\n  AND protopayload_auditlog.status.code != 0\nORDER BY timestamp DESC\nLIMIT 500;\n```\n\n## Alerting Policies\n\n```bash\n# Alert on service account key creation\ngcloud alpha monitoring policies create \\\n  --display-name=\"SA Key Created\" \\\n  --condition-display-name=\"Service Account Key Creation\" \\\n  --condition-filter='resource.type=\"audited_resource\" AND protoPayload.methodName=\"google.iam.admin.v1.CreateServiceAccountKey\"' \\\n  --condition-threshold-value=0 \\\n  --condition-threshold-comparison=COMPARISON_GT \\\n  --condition-threshold-duration=0s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID \\\n  --combiner=OR\n\n# Create a log-based metric for IAM changes\ngcloud logging metrics create iam-policy-changes \\\n  --description=\"Count of IAM policy changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\" AND protoPayload.methodName=\"SetIamPolicy\"'\n\n# Create alerting policy using the log-based metric\ngcloud alpha monitoring policies create \\\n  --display-name=\"IAM Policy Changes\" \\\n  --condition-display-name=\"IAM Changes Detected\" \\\n  --condition-filter='metric.type=\"logging.googleapis.com\u002Fuser\u002Fiam-policy-changes\"' \\\n  --condition-threshold-value=0 \\\n  --condition-threshold-comparison=COMPARISON_GT \\\n  --condition-threshold-duration=0s \\\n  --notification-channels=projects\u002FPROJECT_ID\u002FnotificationChannels\u002FCHANNEL_ID\n\n# Create log-based metric for firewall changes\ngcloud logging metrics create firewall-rule-changes \\\n  --description=\"Count of firewall rule changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\"\n    AND (protoPayload.methodName=\"v1.compute.firewalls.insert\"\n    OR protoPayload.methodName=\"v1.compute.firewalls.delete\"\n    OR protoPayload.methodName=\"v1.compute.firewalls.patch\")'\n\n# Create log-based metric for VPC network changes\ngcloud logging metrics create vpc-network-changes \\\n  --description=\"Count of VPC network changes\" \\\n  --log-filter='logName:\"cloudaudit.googleapis.com\u002Factivity\"\n    AND resource.type=\"gce_network\"\n    AND (protoPayload.methodName=~\"insert$\" OR protoPayload.methodName=~\"delete$\")'\n```\n\n## Terraform Configuration\n\n```hcl\n# Organization-level audit log sink to BigQuery\nresource \"google_logging_organization_sink\" \"audit_bigquery\" {\n  name             = \"org-audit-bigquery\"\n  org_id           = var.org_id\n  destination      = \"bigquery.googleapis.com\u002Fprojects\u002F${var.project_id}\u002Fdatasets\u002F${google_bigquery_dataset.audit_logs.dataset_id}\"\n  filter           = \"logName:\\\"cloudaudit.googleapis.com\\\"\"\n  include_children = true\n\n  bigquery_options {\n    use_partitioned_tables = true\n  }\n}\n\nresource \"google_bigquery_dataset\" \"audit_logs\" {\n  dataset_id    = \"audit_logs\"\n  project       = var.project_id\n  location      = \"US\"\n  description   = \"Organization audit log export\"\n\n  default_table_expiration_ms = null  # No auto-expiry\n\n  access {\n    role          = \"WRITER\"\n    user_by_email = google_logging_organization_sink.audit_bigquery.writer_identity\n  }\n\n  access {\n    role          = \"READER\"\n    group_by_email = \"security-auditors@example.com\"\n  }\n}\n\n# Retention bucket with bucket lock\nresource \"google_storage_bucket\" \"audit_archive\" {\n  name          = \"org-audit-logs-archive\"\n  location      = \"US\"\n  force_destroy = false\n  project       = var.project_id\n\n  uniform_bucket_level_access = true\n\n  retention_policy {\n    is_locked        = true\n    retention_period = 220752000  # 7 years in seconds\n  }\n\n  lifecycle_rule {\n    condition {\n      age = 90\n    }\n    action {\n      type          = \"SetStorageClass\"\n      storage_class = \"COLDLINE\"\n    }\n  }\n}\n\n# Log-based alerting\nresource \"google_logging_metric\" \"iam_changes\" {\n  name    = \"iam-policy-changes\"\n  project = var.project_id\n  filter  = \"logName:\\\"cloudaudit.googleapis.com\u002Factivity\\\" AND protoPayload.methodName=\\\"SetIamPolicy\\\"\"\n\n  metric_descriptor {\n    metric_kind = \"DELTA\"\n    value_type  = \"INT64\"\n  }\n}\n\nresource \"google_monitoring_alert_policy\" \"iam_changes\" {\n  display_name = \"IAM Policy Changes Detected\"\n  project      = var.project_id\n  combiner     = \"OR\"\n\n  conditions {\n    display_name = \"IAM policy change count\"\n    condition_threshold {\n      filter          = \"metric.type=\\\"logging.googleapis.com\u002Fuser\u002Fiam-policy-changes\\\" AND resource.type=\\\"global\\\"\"\n      comparison      = \"COMPARISON_GT\"\n      threshold_value = 0\n      duration        = \"0s\"\n    }\n  }\n\n  notification_channels = [var.notification_channel_id]\n}\n```\n\n\n## Contents\n\n- [Setup Checklist](references\u002Fdetails.md)\n- [Best Practices](references\u002Fdetails.md)\n\n## When to Use\n\n- Enabling organization-wide audit logging across GCP projects\n- Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP\n- Investigating unauthorized access or suspicious API activity\n- Setting up alerting on administrative and data access events\n- Exporting logs to BigQuery for long-term analysis and reporting\n\n## Limitations\n\n- Guidance and checklists only; not legal advice and not a substitute for a qualified auditor.\n- Docs-only import: upstream templates and scripts not bundled.\n\n### Example\n\n```markdown\nMap this skill's control checklist to our current evidence and list gaps.\n```\n\n> Adapted from [BagelHole\u002FDevOps-Security-Agent-Skills](https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use\u002FLimitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.\n",{"name":5,"risk":43,"source":44,"license":14,"category":45,"metadata":46,"date_added":49,"description":7,"source_repo":50,"source_type":27,"compatibility":51,"license_source":52},"safe","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills","security",{"author":47,"version":48},"devops-skills","1.0","2026-09-20","BagelHole\u002FDevOps-Security-Agent-Skills","Checklist and framework guidance; no privileged tooling required. Apply controls through your own change process.","https:\u002F\u002Fgithub.com\u002FBagelHole\u002FDevOps-Security-Agent-Skills\u002Fblob\u002Fmain\u002FLICENSE","f3312ba749561b6159f477dbfc9313c875d40a56",".agents\u002Fskills_archive\u002Fgcp-audit-logs","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612","2026-10-25 23:50:58",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-audit-logs",{"tool":64,"command":65},"bunx","bunx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-audit-logs",{"tool":67,"command":68},"pnpm","pnpm dlx skills add duc-duy-1612\u002FOnline-Delivery-Systems-Web --skill gcp-audit-logs","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fgcp-audit-logs\u002FSKILL.md",true,[72],{"path":73,"resourceType":74,"resourceTypeDesc":75,"sizeBytes":76,"sourceHtmlUrl":77},"references\u002Fdetails.md","REFERENCE","参考文档",2677,"https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fgcp-audit-logs\u002Freferences\u002Fdetails.md",[79,106,130,153,181,205],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":90,"publishedAt":38},"01M6Q0FA5FZ410Z33Z3TFQ4DBA","zero-trust","Implement zero-trust network architecture. Configure identity-based access, micro-segmentation, and continuous verification. Use when implementing modern security architectures.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzero-trust\u002FSKILL.md",[85],{"categoryNo":86,"categoryName":87,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[91,92,93,94,95,96,81,97,34,98,32,99,27,26,100,101,102,103,104,105],"ZeRO","trust","zero trust","architecture","assessment","verification","segmentation","access","only","active","critical","scope","scripts","relevant","implementing",{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":38},"01M6Q0F1YZJW3KX5FBKEVZ8CV4","zcode-delegate","Delegate coding tasks to the Z.AI ZCode CLI only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fzcode-delegate\u002FSKILL.md",[],[113,114,115,116,117,118,119,120,121,122,123,124,125,99,126,27,127,128,101,129],"delegate","zcode","zcode delegate","review","cli","orchestration","tasks","run","Bash","model","node","read","orchestrator","files","desktop app","app","agent-orchestration",{"skillNo":131,"name":132,"nameZh":6,"description":133,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":134,"categories":135,"keywords":136,"publishedAt":38},"01M6Q0ETK41VGNMYEXW0T00AJN","youtube-transcript","Fetch YouTube transcripts through DeepAPI or local fallback tooling and save clean text output.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript\u002FSKILL.md",[],[137,138,139,43,140,141,142,36,143,144,145,146,147,27,26,148,149,150,151,152],"transcript","youtube transcript","youtube","github","codex","research","https","text","fetch","tooling","clean","local","output","deepapi","youtube transcripts","blob",{"skillNo":154,"name":155,"nameZh":6,"description":156,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":157,"categories":158,"keywords":170,"publishedAt":38},"01M6Q0EPPH2PVMDW40017F8WX0","youtube-transcript-skills","Fetch YouTube video transcripts, search videos\u002Fchannels, browse channels, and extract playlists via the getyoutubetranscript.com API - free tier, no card required.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-transcript-skills\u002FSKILL.md",[159,162,165],{"categoryNo":160,"categoryName":161,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":163,"categoryName":164,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000016","图像与多媒体",{"categoryNo":166,"categoryName":167,"taxonomyType":168,"taxonomyTypeDesc":169},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[137,138,139,171,43,172,140,141,36,173,174,175,176,145,177,27,26,178,179,180],"youtube transcript skills","gemini","search","api","Video","browse","api-integration","free","card","channels",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":191,"publishedAt":38},"01M6Q0EAB96PX83W5PTE8A0R8D","youtube-notetaker","Turn YouTube talks into local study notes with slides, transcripts, editable annotations, and a markdown-backed viewer.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-notetaker\u002FSKILL.md",[187,190],{"categoryNo":188,"categoryName":189,"taxonomyType":88,"taxonomyTypeDesc":89},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":163,"categoryName":164,"taxonomyType":88,"taxonomyTypeDesc":89},[139,192,193,117,43,194,195,196,197,36,175,198,199,200,201,26,202,148,203,204],"youtube notetaker","notetaker","workflow","official","notes","code","markdown","slides","annotations","README","study","dair-academy","viewer",{"skillNo":206,"name":207,"nameZh":6,"description":208,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":6,"repositoryNo":12,"starsCount":13,"licenseSpdxId":14,"licenseFileUrl":6,"sourceHtmlUrl":209,"categories":210,"keywords":212,"publishedAt":38},"01M6Q0E55F0GW5MX48V8HXS8B5","youtube-full","Fetch YouTube transcripts, search videos, browse channels, and extract playlists via TranscriptAPI — no yt-dlp, no Google API key, works from any cloud server.","https:\u002F\u002Fgithub.com\u002Fduc-duy-1612\u002FOnline-Delivery-Systems-Web\u002Fblob\u002Fmain\u002F.agents\u002Fskills_archive\u002Fyoutube-full\u002FSKILL.md",[211],{"categoryNo":160,"categoryName":161,"taxonomyType":88,"taxonomyTypeDesc":89},[213,139,214,215,43,172,173,216,217,174,175,176,145,218,177,27,26,178,219,151],"youtube full","full","google","server","dlp","credits","automatic"]