Skip to main content
The Google Cloud Audit Logs integration reads Admin Activity audit logs from every project in your Google Cloud organization. It collects the changes that make a project usable for Gemini and Vertex AI: API keys being created or restricted, APIs being enabled, and Vertex AI configuration changes. The Google Workspace Reports API does not include this activity.
Admin Activity audit logs are always on and free. You do not need to enable Data Access logs or create a log sink.

​
Prerequisites

  • A Google Cloud organization
  • Permission to grant roles at the organization level
  • A dedicated project for the Wirespeed service account, where you can create service accounts and keys and enable APIs (for example as project Owner, or with Service Account Admin, Service Account Key Admin, and Service Usage Admin)

​
Required Roles

Grant both roles on the organization, not on a project, so that they apply to every project, including new ones:
Admin Activity audit logs are stored in the _Required bucket of the project that generated them. Wirespeed reads each project directly, so the roles must be granted at the organization level for every project to be covered.

​
Setup Instructions

​
Step 1: Create a Service Account

  1. Open the Google Cloud Console.
  2. Select a project dedicated to Wirespeed, or create one. Use a project with no other service accounts: if you have to allow key creation in Step 3, that exception applies to every service account in the project.
  3. Go to IAM & Admin > Service Accounts.
  4. Click Create Service Account.
  5. Enter a name, for example wirespeed-audit-logs, and click Create and Continue.
  6. Skip the optional project roles and click Done.

​
Step 2: Enable the APIs

Wirespeed’s requests count against the quota of the service account’s project, so these APIs must be enabled there:
  1. In the same project, go to APIs & Services > Library.
  2. Enable the Cloud Resource Manager API.
  3. Enable the Cloud Logging API.

​
Step 3: Create a JSON Key

  1. Go back to IAM & Admin > Service Accounts and open the service account you created.
  2. Go to the Keys tab.
  3. Click Add Key > Create new key.
  4. Select JSON and click Create. The key file downloads automatically.
  5. Open the file and copy its entire contents, from the opening { to the closing }.
Keep this file secure. It grants read access to your organization’s audit logs. Delete it once it is saved in Wirespeed.
If Google reports Service account key creation is disabled, your organization enforces the iam.disableServiceAccountKeyCreation policy. Organizations created since May 2024 enforce it by default. An Organization Policy Administrator (roles/orgpolicy.policyAdmin) can allow keys for this project only: in IAM & Admin > Organization Policies, open Disable service account key creation, choose Override parent’s policy, and add a rule with Enforcement set to Off. This is a security exception to your organization’s policy against long-lived credentials, so apply it only to the dedicated Wirespeed project.

​
Step 4: Grant the Organization Roles

  1. Select your organization in the project picker.
  2. Go to IAM & Admin > IAM and click Grant Access.
  3. In New principals, enter the service account email (client_email in the JSON key).
  4. Add the Browser (roles/browser) and Logs Viewer (roles/logging.viewer) roles.
  5. Click Save.

​
Step 5: Find Your Organization ID

  1. With your organization selected, go to IAM & Admin > Settings.
  2. Copy the Organization ID.

​
Step 6: Configure Wirespeed

  1. In Wirespeed, go to Integrations > Add Integration.
  2. Select Google Cloud Audit Logs.
  3. Enter the Organization ID from Step 5 and paste the Service account key from Step 3.
  4. Click Save.
Wirespeed checks both roles when the integration connects. Role grants can take a few minutes to apply, so a warning right after setup can clear on the next check.

​
What Events Are Collected?

Wirespeed collects Admin Activity audit log entries (cloudaudit.googleapis.com/activity) from every active project in the organization for three services: Each entry keeps the full audit record, with the caller’s email, the caller’s IP address, the project, and the API method available for search. The first sync reads the previous hour. Each poll then reads the window since the last one, about five minutes behind real time so that entries Cloud Logging has not finished storing are not skipped. Wirespeed refreshes the project list every hour. When a refresh finds a new project, Wirespeed reads that project’s logs from the previous two hours, so changes made right after a project is created are still collected.
Cloud Logging allows 60 log read requests per minute, and the limit cannot be raised. Wirespeed reads up to 100 projects per request, so an organization with 1,000 projects needs at least 10 requests per poll, plus one for each additional page of results when there is a lot of activity.

​
Managed Detections

Wirespeed evaluates the collected logs with this managed detection. It is experimental while Wirespeed measures how often it fires: API key events are collected for search but do not raise a detection. Cloud Audit Logs records the key in API Keys requests and responses as an empty object, so the log does not show which APIs a key can call. Vertex AI configuration changes are collected for search but do not raise a detection. Teams that use Vertex AI make these changes as part of normal work, and no single change reliably separates misuse from use.

​
Troubleshooting

​
Warning: Wirespeed Cannot List Projects

The credentials are missing Browser (roles/browser) on the organization, or the Cloud Resource Manager API is disabled in the credentials’ project. Grant the role at the organization level, then wait for the next permission check.

​
Warning: Wirespeed Cannot Read Cloud Logging

The credentials are missing Logs Viewer (roles/logging.viewer) on the organization, or the Cloud Logging API is disabled in the credentials’ project. Grant the role at the organization level, then wait for the next permission check.

​
Quota Exceeded

A 429 error means the 60-requests-per-minute log read quota was used up, often by other tools reading logs with the same project’s credentials. Wirespeed retries the same window on the next poll, so no logs are skipped.