Google Cloud Audit Logs has four types. Admin Activity, System Event and Policy Denied logs are written by default. Data Access logs are off by default, except for BigQuery, because they can be large and costly. If you need to answer who read this data, you must enable them yourself.
The four log types
Google describes them like this:
- Admin Activity: user-driven API calls that change configuration or metadata, such as creating a VM or changing IAM permissions.
- Data Access: calls that read configuration or metadata, and calls that create, modify or read user-provided data.
- System Event: configuration changes made by Google Cloud systems, not by a person. Autoscaling adding VMs is an example.
- Policy Denied: access denied to a user or service account because of a security policy violation.
What is on and what you can change
- Admin Activity: Default: Always written; Can you disable it: No
- System Event: Default: Always written; Can you disable it: No
- Policy Denied: Default: Written; Can you disable it: Cannot be disabled, but exclusion filters can stop storage
- Data Access: Default: Off, except BigQuery; Can you disable it: You choose whether to enable it
Admin Activity and System Event entries go to the _Required bucket, which you cannot configure. Enabled Data Access logs and Policy Denied logs go to the _Default bucket. Google notes that audit log entries are immutable.
Why Data Access is off
Reading data is far more frequent than changing configuration. Logging every read for every storage object can generate large volumes, and Google warns that enabling these logs may increase your logging charges. That cost tradeoff is why the setting is yours to make.
What to turn on
Do not switch on everything blindly. A practical order:
- Start with the services that hold your most sensitive data, such as storage with customer data, databases and secrets stores.
- Enable the read and write categories you need for investigations. Be clear whether you need admin reads, data reads or data writes.
- Route the logs to a sink with the retention you need, rather than relying on the default bucket alone. Retention periods are listed in Google's logging quotas documentation, which you should check for current values.
- Review the cost after a week and adjust.
Without Data Access logs, an investigation after a suspected leak can show who changed permissions, but may not show who downloaded the files. That gap is the one most teams discover too late.
Pairing with preventive settings
Audit logs tell you what happened. Pair them with controls that stop the common mistakes, such as public access prevention on buckets and disabled service account key creation. Detection and prevention cover each other's gaps.
Quick check
Are Admin Activity logs enough for incident response?
Often not. They show configuration changes, but not reads of user data. For data theft questions you need Data Access logs enabled before the event.
Can I switch Data Access logs on after an incident?
You can switch them on, but they will not record anything that happened earlier.
Sources
Last reviewed: 19 October 2026.
