Audit log
Search and export accountable records of infrastructure and policy changes.
The audit log records authenticated administrative actions and accepted resource changes. It identifies the actor, scope, target, request, and resulting operation.
Record fields
Each record has an immutable event ID and UTC timestamp. Actor identifies a member, service account, or system principal. Action and target IDs identify the requested change independently of mutable display names.
Scope records the organization, project, and region when applicable. Request ID connects the console or API call to its audit entry; operation ID connects accepted asynchronous work to execution. Recorded changes redact protected values while retaining secret references and revisions.
Read the Audit API for the JSON envelope and audit streaming for cursor and acknowledgement behavior.
An accepted mutation can later fail during infrastructure execution. Read the linked operation for its terminal result. An audit event alone does not prove the requested configuration became active.
Search
Open Organization settings → Audit or the Audit tab on a resource. Filter by actor, action, project, region, resource ID, request ID, and time range. Use immutable IDs when names have changed or resources have been deleted.
Project-scoped audit access excludes unrelated organization records. Export permissions are separately assignable to an Auditor or custom role.
Sensitive data
Secret values, passwords, enrollment tokens, and bearer credentials are excluded from ordinary change payloads. Secret-reference changes record the reference and revision so credential rotation remains attributable.
User-supplied names and labels can appear in audit data. Do not put secrets or personal information in those fields merely because they are convenient for search.
Export
Choose a bounded time range and export the selected records. The export includes its scope, filters, generation time, and event IDs. Store it in an access-controlled destination permitted by residency policy.
Audit streaming uses durable event cursors and explicit replay. An external audit sink receives records asynchronously. Delivery lag and failed attempts are visible in the sink configuration. A disconnected sink does not mean no audit events occurred; compare its cursor with retained local records.
Retention
Organization policy controls retention. A shorter retention value affects the next cleanup evaluation; it does not shorten an external archive's retention. A retention lock can prevent earlier removal according to its configured scope.
Deleting a resource does not remove its retained audit history. Records can continue to show the deleted ID and its name at event time. Export required records before project or installation decommissioning.
Investigation
Start with the resource ID, find the accepted request, and open its operation. Compare configuration revision, component journal, and current observed state. For an unauthorized change, revoke the actor's credentials and review its other recent actions through Roles and teams.