Question

A financial services company must be able to prove exactly which principals read the contents of sensitive objects in a specific Cloud Storage bucket during forensic investigations. During a recent incident, the security team discovered that Cloud Logging showed no records of object reads, only administrative changes to the bucket configuration. They need read operations to be captured going forward with minimal blast radius. What should the team configure?

Accepted Answer

Enable Data Access audit logs for the DATA_READ log type on the Cloud Storage service, scoping the configuration to the relevant project or resource.

Answer

Rely on Admin Activity audit logs, which are enabled by default and record all access to Cloud Storage objects.

Answer

Create a log-based metric on Admin Activity logs to alert whenever an object is downloaded from the bucket.

Answer

Enable VPC Flow Logs on the subnet used by clients accessing the bucket to capture object read activity.