Audit Logs that Record What Was Read
Data Access logs are off by default for every service but BigQuery, so a project that never turned them on has no record of who read the bucket, queried the table or fetched the secret. Enables all three log types for allServices, narrows per service where read volume is a real cost, and requires a reason for every exempted member - the setting an intruder with IAM rights would add.
Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- No applicable security policies for this provider
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-14 · how we verify
Use it from the registry
terraform · opentofumodule "audit_logging" {
source = "www.iac-bazaar.com/iac-bazaar/gcp-audit-logging/gcp"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
gcp-audit-logging
Cloud Audit Logs that record what was read, not only what was changed. Works
with Terraform and OpenTofu (>= 1.6), google provider >= 6.0, < 7.0.
Data Access logs are off by default for every service but BigQuery. Admin
Activity logs are always on and free: who created the bucket, who changed the
IAM policy. Data Access logs are the other half - who read the bucket, who
queried the table, who fetched the secret - and a project that never turned
them on has no record of the read that mattered. This module enables
ADMIN_READ, DATA_READ and DATA_WRITE for allServices, and lets you
narrow it per service where the volume is a real cost, deliberately, rather
than everywhere. Dropping DATA_READ globally needs accept_no_data_read.
Every exemption is a member whose reads leave no record. It exists for a
noisy service account; it is also exactly what an intruder with IAM rights
would add. Each carries a reason and they are exported as
exempted_members.
_Default retention is 30 days, and Data Access logs land there. See
gcp-log-sink for retention and export; this module is about whether the
entry is written at all.
Access Approval is the other reader. Google staff can access content for support cases; Access Transparency logs it afterwards, Access Approval makes them ask first. Optional, because it needs Access Transparency on the organisation.
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
Related modules
gcp-log-sink
Creating a sink creates a service account for it and grants that account nothing, so until it holds a role on the destination every export fails - the sink shows active, the destination stays empty, and the errors are logged into the project that was supposed to be exported. Grants the role with the sink, refuses an empty filter, and can manage _Default retention past 30 days.
gcp-monitoring
A self-contained observability bundle: a metric-threshold alert policy, a Monitoring dashboard, and a log-export sink to a locked-down GCS bucket with the sink writer-identity IAM grant wired in.