Is Audit logging enabled by default on GCP

Question

Does GCP have audit logging enabled by default?

I'm interested in logs which record when VM instances and App Engine applications are created.

However, I've tried creating a VM instance on my project's compute Engine and checking the Stackdriver logs, however nothing shows up.

I don't think it's a permissions issue, as I have the permissions and can see various older logs in the Audited Resource category.

Answer 1

The first thing to know about Cloud Audit Logging is that each project consists of two log streams: admin activity and data access.

GCP services generate these logs to help you answer the question of "who did what, where, and when?" within your GCP projects.

Further, these logs are distinct from your application logs.

• Admin activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin activity logs are always enabled. There's no charge for admin activity audit logs, and they're retained for 13 months/400 days.

• Data access logs, on the other hand, record API calls that create, modify or read user-provided data. Data access audit logs are disabled by default because they can grow to be quite large.