Google Distributed Cloud audit logging

This document describes audit logging for Google Distributed Cloud. It describes which methods are audited and details about the audit log each method produces. It lists which methods do not produce audit logs, if any. Google Cloud services write audit logs that record administrative activities and accesses within your Google Cloud resources. For more information, see Cloud Audit Logs overview.

Service name

Google Distributed Cloud audit logs use the service name edgecontainer.googleapis.com.

Methods by permission type

Methods that check DATA_READ, DATA_WRITE, and ADMIN_READ permission types generate Data Access audit logs. Methods that check ADMIN_WRITE permission types generate Admin Activity audit logs.

Permission type Methods

ADMIN_READ google.cloud.edgecontainer.v1.EdgeContainer.GenerateAccessToken
google.cloud.edgecontainer.v1.EdgeContainer.GenerateOfflineCredential
google.cloud.edgecontainer.v1.EdgeContainer.GetCluster
google.cloud.edgecontainer.v1.EdgeContainer.GetMachine
google.cloud.edgecontainer.v1.EdgeContainer.GetNodePool
google.cloud.edgecontainer.v1.EdgeContainer.GetServerConfig
google.cloud.edgecontainer.v1.EdgeContainer.GetVpnConnection
google.cloud.edgecontainer.v1.EdgeContainer.ListClusters
google.cloud.edgecontainer.v1.EdgeContainer.ListMachines
google.cloud.edgecontainer.v1.EdgeContainer.ListNodePools
google.cloud.edgecontainer.v1.EdgeContainer.ListVpnConnections

ADMIN_WRITE google.cloud.edgecontainer.v1.EdgeContainer.CreateCluster
google.cloud.edgecontainer.v1.EdgeContainer.CreateNodePool
google.cloud.edgecontainer.v1.EdgeContainer.CreateVpnConnection
google.cloud.edgecontainer.v1.EdgeContainer.DeleteCluster
google.cloud.edgecontainer.v1.EdgeContainer.DeleteNodePool
google.cloud.edgecontainer.v1.EdgeContainer.DeleteVpnConnection
google.cloud.edgecontainer.v1.EdgeContainer.UpdateNodePool

Permission type	Methods
`ADMIN_READ`	`google.cloud.edgecontainer.v1.EdgeContainer.GenerateAccessToken` `google.cloud.edgecontainer.v1.EdgeContainer.GenerateOfflineCredential` `google.cloud.edgecontainer.v1.EdgeContainer.GetCluster` `google.cloud.edgecontainer.v1.EdgeContainer.GetMachine` `google.cloud.edgecontainer.v1.EdgeContainer.GetNodePool` `google.cloud.edgecontainer.v1.EdgeContainer.GetServerConfig` `google.cloud.edgecontainer.v1.EdgeContainer.GetVpnConnection` `google.cloud.edgecontainer.v1.EdgeContainer.ListClusters` `google.cloud.edgecontainer.v1.EdgeContainer.ListMachines` `google.cloud.edgecontainer.v1.EdgeContainer.ListNodePools` `google.cloud.edgecontainer.v1.EdgeContainer.ListVpnConnections`
`ADMIN_WRITE`	`google.cloud.edgecontainer.v1.EdgeContainer.CreateCluster` `google.cloud.edgecontainer.v1.EdgeContainer.CreateNodePool` `google.cloud.edgecontainer.v1.EdgeContainer.CreateVpnConnection` `google.cloud.edgecontainer.v1.EdgeContainer.DeleteCluster` `google.cloud.edgecontainer.v1.EdgeContainer.DeleteNodePool` `google.cloud.edgecontainer.v1.EdgeContainer.DeleteVpnConnection` `google.cloud.edgecontainer.v1.EdgeContainer.UpdateNodePool`

Audit logs for each API interface

For more information about which permissions are evaluated for each method, see the Identity and Access Management documentation for Google Distributed Cloud.

`google.cloud.edgecontainer.v1.EdgeContainer`

The following section contains details about audit logs associated with methods belonging to google.cloud.edgecontainer.v1.EdgeContainer.

`google.cloud.edgecontainer.v1.EdgeContainer.CreateCluster`

Method: google.cloud.edgecontainer.v1.EdgeContainer.CreateCluster
Audit log type: Admin activity
Permissions:
- edgecontainer.clusters.create - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.CreateCluster"

`google.cloud.edgecontainer.v1.EdgeContainer.CreateNodePool`

Method: google.cloud.edgecontainer.v1.EdgeContainer.CreateNodePool
Audit log type: Admin activity
Permissions:
- edgecontainer.nodePools.create - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.CreateNodePool"

`google.cloud.edgecontainer.v1.EdgeContainer.CreateVpnConnection`

Method: google.cloud.edgecontainer.v1.EdgeContainer.CreateVpnConnection
Audit log type: Admin activity
Permissions:
- edgecontainer.vpnConnections.create - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.CreateVpnConnection"

`google.cloud.edgecontainer.v1.EdgeContainer.DeleteCluster`

Method: google.cloud.edgecontainer.v1.EdgeContainer.DeleteCluster
Audit log type: Admin activity
Permissions:
- edgecontainer.clusters.delete - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.DeleteCluster"

`google.cloud.edgecontainer.v1.EdgeContainer.DeleteNodePool`

Method: google.cloud.edgecontainer.v1.EdgeContainer.DeleteNodePool
Audit log type: Admin activity
Permissions:
- edgecontainer.nodePools.delete - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.DeleteNodePool"

`google.cloud.edgecontainer.v1.EdgeContainer.DeleteVpnConnection`

Method: google.cloud.edgecontainer.v1.EdgeContainer.DeleteVpnConnection
Audit log type: Admin activity
Permissions:
- edgecontainer.vpnConnections.delete - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.DeleteVpnConnection"

`google.cloud.edgecontainer.v1.EdgeContainer.GenerateAccessToken`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GenerateAccessToken
Audit log type: Data access
Permissions:
- edgecontainer.clusters.generateAccessToken - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GenerateAccessToken"

`google.cloud.edgecontainer.v1.EdgeContainer.GenerateOfflineCredential`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GenerateOfflineCredential
Audit log type: Data access
Permissions:
- edgecontainer.clusters.generateOfflineCredential - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GenerateOfflineCredential"

`google.cloud.edgecontainer.v1.EdgeContainer.GetCluster`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GetCluster
Audit log type: Data access
Permissions:
- edgecontainer.clusters.get - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GetCluster"

`google.cloud.edgecontainer.v1.EdgeContainer.GetMachine`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GetMachine
Audit log type: Data access
Permissions:
- edgecontainer.machines.get - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GetMachine"

`google.cloud.edgecontainer.v1.EdgeContainer.GetNodePool`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GetNodePool
Audit log type: Data access
Permissions:
- edgecontainer.nodePools.get - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GetNodePool"

`google.cloud.edgecontainer.v1.EdgeContainer.GetServerConfig`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GetServerConfig
Audit log type: Data access
Permissions:
- edgecontainer.serverconfig.get - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GetServerConfig"

`google.cloud.edgecontainer.v1.EdgeContainer.GetVpnConnection`

Method: google.cloud.edgecontainer.v1.EdgeContainer.GetVpnConnection
Audit log type: Data access
Permissions:
- edgecontainer.vpnConnections.get - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.GetVpnConnection"

`google.cloud.edgecontainer.v1.EdgeContainer.ListClusters`

Method: google.cloud.edgecontainer.v1.EdgeContainer.ListClusters
Audit log type: Data access
Permissions:
- edgecontainer.clusters.list - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.ListClusters"

`google.cloud.edgecontainer.v1.EdgeContainer.ListMachines`

Method: google.cloud.edgecontainer.v1.EdgeContainer.ListMachines
Audit log type: Data access
Permissions:
- edgecontainer.machines.list - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.ListMachines"

`google.cloud.edgecontainer.v1.EdgeContainer.ListNodePools`

Method: google.cloud.edgecontainer.v1.EdgeContainer.ListNodePools
Audit log type: Data access
Permissions:
- edgecontainer.nodePools.list - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.ListNodePools"

`google.cloud.edgecontainer.v1.EdgeContainer.ListVpnConnections`

Method: google.cloud.edgecontainer.v1.EdgeContainer.ListVpnConnections
Audit log type: Data access
Permissions:
- edgecontainer.vpnConnections.list - ADMIN_READ
Method is a long-running or streaming operation: No.
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.ListVpnConnections"

`google.cloud.edgecontainer.v1.EdgeContainer.UpdateNodePool`

Method: google.cloud.edgecontainer.v1.EdgeContainer.UpdateNodePool
Audit log type: Admin activity
Permissions:
- edgecontainer.nodePools.update - ADMIN_WRITE
Method is a long-running or streaming operation: Long running operation
Filter for this method: protoPayload.methodName="google.cloud.edgecontainer.v1.EdgeContainer.UpdateNodePool"