how to do Logging & Monitoring on Google Cloud Storage Buckets with IAM user

kingfateh khan 0
Viewed 38

I want to create an alerting mechanism for GCS bucket events where users within my organization or my IAM users do anything on Buckets like Downloading, updating, or deleting, any object I should get an alert but I have no idea how I suppose to do this.

So far I have managed to create an alert if a user deletes anything or creates anything I got an alert on my slack channel

but I have no idea how I implement the above mention use case.

google-cloud-monitoring google-cloud-logging google-cloud-storage google-cloud-platform
2 Answers

You have to activate the audit logs on Cloud Storage (be careful it can generate a lot of logs and then cost a lot, use with caution).

Then you can do what you want with your logs:

  • Create a log based metrics and then an alert on that metrics (logs with read, write, delete operation)
  • Create a Cloud Logging sink to send messages in PubSub to script the action on each event (send an email, send a slack message,...)
  • Create a Cloud Logging sink to BigQuery and perform a periodic query followed by a formatted email with the query result to have a periodic report
guillaume blaquiere0

We can interpret the following from the above case:

  • Individual A is trying to get notifications for the version changes(Creation, Deletion and Updating) and for actions like copying, downloading, uploading, etc., of the objects stored in GCS
  • Generally it will be within the organization as other parties will be restricted from accessing sensitive information stored in the buckets but if there are other users apart from within the organization we can create filters and send out the notifications.
  • Individual A wishes to receive alerts in slack.

There is a solution available for this in the GCP official documentation. It clearly explains how to enable notifications, how to filter the content and how to create and use pub/sub topics for sending the notifications. Since the preferred medium is slack, he can use this link for configuring slack notifications.

userPFGi10
Related