Google Cloud Storage Audit Logs

Location

Description

Bucket and object access audit records for Google Cloud Storage, including reads, writes, deletes, ACL changes, and bucket-configuration modifications when the relevant audit streams are enabled.

Forensic Value

Cloud Storage audit logs are critical for confirming what data was accessed or exfiltrated from GCS. They show the actor, bucket, object path, and operation type, enabling investigators to distinguish between permission changes and actual object access.

Tools Required

Collection Commands

gcloud logging read "resource.type="gcs_bucket" AND timestamp>="2026-03-01T00:00:00Z"" --format=json > gcs_audit_logs.json

Filter by resource.type="gcs_bucket" and methodName/object identifiers, then export evidence for the incident window

Collection Constraints

• •High-value object-read visibility usually depends on Data Access audit logging being enabled before the incident.
• •Audit logs record object access metadata, not a preserved copy of the object payload.

MITRE ATT&CK Techniques

References