Question

Your security team must know exactly when your application's service account reads objects from a specific Cloud Storage bucket. You check Cloud Logging but see no records of these read operations, even though you can see who changed the bucket's IAM policy. What must you do to capture the read events?

Accepted Answer

Enable Data Access audit logs (DATA_READ) for Cloud Storage in the IAM audit configuration.

Answer

Grant the service account the roles/logging.viewer role so its reads are recorded.

Answer

Enable Access Transparency logs for the organization.

Answer

Create a log-based metric filtered on storage.objects.get events.