Question

A security analyst must be alerted whenever any user downloads (creates) a service account key across the organization, because service account key creation is prohibited by policy except for one legacy break-glass workflow. The analyst wants near-real-time notification with minimal custom code, using data already present in Admin Activity audit logs. What is the most appropriate approach?

Accepted Answer

Create a log-based metric that matches the `google.iam.admin.v1.CreateServiceAccountKey` method name in the audit logs, then configure a Cloud Monitoring alerting policy on that metric to notify the analyst.

Answer

Enable Data Access audit logs for the IAM API and build a BigQuery scheduled query that scans for key creation events each hour.

Answer

Apply an organization policy constraint that disables service account key creation, which will automatically email the analyst when a key is created.

Answer

Export all Admin Activity logs to Cloud Storage and configure Object Lifecycle notifications to trigger when new key-related objects appear.