How do you budget for security logging on Google Cloud?

Budget Google Cloud security logging by sorting logs into three groups: audit logs that are always stored, Data Access logs you must opt into, and everything you route or retain longer. Measure volume for each, then multiply by the current published rate. This post gives the method and no prices. Docs checked 18 October 2026.

Which logs are always on?

Google's Cloud Audit Logs documentation lists four types per project, folder and organization: Admin Activity, Data Access, System Event and Policy Denied. Admin Activity and System Event entries are stored in a bucket named _Required. The documentation says you can't prevent them from being stored, you can't configure the sink that routes them, and you can't change the retention of that bucket. Nothing to decide there, but it is the base of your audit trail.

Policy Denied logs are generated by default and the project is charged for their storage. You can't disable them, but exclusion filters can keep them out of Cloud Logging.

Which logs cost extra when you enable them?

Data Access audit logs record API calls that read configuration or metadata, plus data reads and writes. Except for BigQuery, they are disabled by default because they can generate large volumes of data, and the docs warn that enabling them might result in additional log usage charges. They are also the logs auditors often ask about, since they show who read what.

That tension is the budgeting problem. The sensible answer is selective enablement: turn on Data Access logs for the services that hold regulated data or secrets, not for every project. The configuration lives in the IAM audit configuration, and you can choose which log types and which services.

Viewing is a separate permission. The Logs Viewer role can't see Data Access logs in the _Default bucket. You need the Private Logs Viewer role, so plan access for your security and audit staff.

How do routing and retention change the bill?

Every project, folder and organization gets two sinks and buckets. The _Default sink matches everything except the audit logs that go to _Required. The Log Router supports one inclusion filter and several exclusion filters per sink. If an entry matches the inclusion filter and any exclusion filter, it isn't routed.

Two limits matter for cost planning. Exclusion filters apply after entries are received by the Logging API, so they don't reduce your write API quota use or call counts. And retention: the default for _Default and user-defined buckets is 30 days, you can set 1 to 3650 days, and the docs state that retention costs apply to data kept longer than the default period.

You can also route logs to other services such as Cloud Storage, BigQuery or Pub/Sub, each with its own pricing page. The audit page points to those and to the Google Cloud Observability pricing page for current rates.

A constructed worked example

A team has 40 projects. Rather than guess, they measure. For one week they use the log buckets view to record bytes per bucket for a sample of 5 projects, including one that holds customer data. They find that two projects with data stores generate most of the volume once Data Access logs are enabled. They decide: Data Access logs on for the two projects holding regulated data, off elsewhere; the _Default retention stays at 30 days; a sink sends audit logs to a locked archive bucket for the longer period their policy requires. Then they take the measured gigabytes per month per tier and multiply by the rates on the pricing page that day, and record the date in the budget sheet.

What to do

1. List which standards or policies set a retention requirement for security logs.
2. Inventory projects and mark the ones holding regulated data or secrets.
3. Enable Data Access logs selectively for those services.
4. Measure bytes per bucket per week before choosing retention.
5. Set retention per bucket to what policy needs, not the maximum.
6. Route long retention audit logs to a cheaper archive destination with restricted access.
7. Use exclusion filters for noisy low value logs, remembering they do not cut API calls.
8. Grant the Private Logs Viewer role to the few people who need Data Access logs.
9. Re-run the estimate each quarter and date the pricing you used.

Safeguard compliance automation can collect evidence that logging is configured, see the framework mapping demo.

Quick check

Sources

• Google Cloud: Cloud Audit Logs overview
• Google Cloud: Routing and storage overview
• Google Cloud: Configure log buckets

Last reviewed: 18 October 2026.