> ## Documentation Index
> Fetch the complete documentation index at: https://docs.wirespeed.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud Audit Logs

> Monitor API key, Service Usage, and Vertex AI changes across every project in your Google Cloud organization

The Google Cloud Audit Logs integration reads Admin Activity audit logs from
every project in your Google Cloud organization. It collects the changes that
make a project usable for Gemini and Vertex AI: API keys being created or
restricted, APIs being enabled, and Vertex AI configuration changes. The Google
Workspace Reports API does not include this activity.

> [!NOTE]
>
> Admin Activity audit logs are always on and free. You do not need to enable
> Data Access logs or create a log sink.

## Prerequisites

* A Google Cloud organization
* Permission to grant roles at the **organization** level
* A dedicated project for the Wirespeed service account, where
  you can create service accounts and keys and enable APIs (for example as
  project **Owner**, or with **Service Account Admin**, **Service Account Key
  Admin**, and **Service Usage Admin**)

## Required Roles

Grant both roles on the **organization**, not on a project, so that they apply
to every project, including new ones:

| Role | Why Wirespeed needs it |
| - | - |
| **Browser** (`roles/browser`) | Lists the projects in the organization |
| **Logs Viewer** (`roles/logging.viewer`) | Reads Admin Activity audit logs in each project |

> [!WARNING]
>
> Admin Activity audit logs are stored in the `_Required` bucket of the project
> that generated them. Wirespeed reads each project directly, so the roles must
> be granted at the organization level for every project to be covered.

## Setup Instructions

### Step 1: Create a Service Account

1. Open the [Google Cloud Console](https://console.cloud.google.com/).
2. Select a project dedicated to Wirespeed, or create one. Use a project with no other service accounts: if you have to allow key creation in Step 3, that exception applies to every service account in the project.
3. Go to **IAM & Admin** > **Service Accounts**.
4. Click **Create Service Account**.
5. Enter a name, for example `wirespeed-audit-logs`, and click **Create and Continue**.
6. Skip the optional project roles and click **Done**.

### Step 2: Enable the APIs

Wirespeed's requests count against the quota of the service account's project,
so these APIs must be enabled there:

1. In the same project, go to **APIs & Services** > **Library**.
2. Enable the **Cloud Resource Manager API**.
3. Enable the **Cloud Logging API**.

### Step 3: Create a JSON Key

1. Go back to **IAM & Admin** > **Service Accounts** and open the service account you created.
2. Go to the **Keys** tab.
3. Click **Add Key** > **Create new key**.
4. Select **JSON** and click **Create**. The key file downloads automatically.
5. Open the file and copy its entire contents, from the opening `{` to the closing `}`.

> [!WARNING]
>
> Keep this file secure. It grants read access to your organization's audit logs. Delete it once it is saved in Wirespeed.

> [!WARNING]
>
> If Google reports **Service account key creation is disabled**, your
> organization enforces the `iam.disableServiceAccountKeyCreation` policy.
> Organizations created since May 2024 enforce it by default. An
> **Organization Policy Administrator** (`roles/orgpolicy.policyAdmin`) can
> allow keys for this project only: in **IAM & Admin** > **Organization
> Policies**, open **Disable service account key creation**, choose
> **Override parent's policy**, and add a rule with **Enforcement** set to
> **Off**. This is a security exception to your organization's policy against
> long-lived credentials, so apply it only to the dedicated Wirespeed project.

### Step 4: Grant the Organization Roles

1. Select your **organization** in the project picker.
2. Go to **IAM & Admin** > **IAM** and click **Grant Access**.
3. In **New principals**, enter the service account email (`client_email` in the JSON key).
4. Add the **Browser** (`roles/browser`) and **Logs Viewer** (`roles/logging.viewer`) roles.
5. Click **Save**.

### Step 5: Find Your Organization ID

1. With your organization selected, go to **IAM & Admin** > **Settings**.
2. Copy the **Organization ID**.

### Step 6: Configure Wirespeed

1. In Wirespeed, go to Integrations > [**Add Integration**](https://app.wirespeed.co/settings/integrations?tab=browse).
2. Select **Google Cloud Audit Logs**.
3. Enter the **Organization ID** from Step 5 and paste the **Service account key** from Step 3.
4. Click **Save**.

Wirespeed checks both roles when the integration connects. Role grants can
take a few minutes to apply, so a warning right after setup can clear on the
next check.

## What Events Are Collected?

Wirespeed collects Admin Activity audit log entries
(`cloudaudit.googleapis.com/activity`) from every active project in the
organization for three services:

| Service | Examples |
| - | - |
| API Keys (`apikeys.googleapis.com`) | API keys created, updated, deleted, or restored |
| Service Usage (`serviceusage.googleapis.com`) | APIs enabled or disabled in a project |
| Vertex AI (`aiplatform.googleapis.com`) | Endpoints, models, datasets, jobs, and other Vertex AI resources created, changed, or deleted |

Each entry keeps the full audit record, with the caller's email, the caller's
IP address, the project, and the API method available for search.

The first sync reads the previous hour. Each poll then reads the window since
the last one, about five minutes behind real time so that entries Cloud
Logging has not finished storing are not skipped.

Wirespeed refreshes the project list every hour. When a refresh finds a new
project, Wirespeed reads that project's logs from the previous two hours, so
changes made right after a project is created are still collected.

> [!NOTE]
>
> Cloud Logging allows 60 log read requests per minute, and the limit cannot be
> raised. Wirespeed reads up to 100 projects per request, so an organization
> with 1,000 projects needs at least 10 requests per poll, plus one for each
> additional page of results when there is a lot of activity.

## Managed Detections

Wirespeed evaluates the collected logs with this managed detection. It is
experimental while Wirespeed measures how often it fires:

| Detection | Activity |
| - | - |
| AI API enabled | The Gemini API or the Vertex AI API is enabled in a project |

API key events are collected for search but do not raise a detection. Cloud
Audit Logs records the key in API Keys requests and responses as an empty
object, so the log does not show which APIs a key can call.

Vertex AI configuration changes are collected for search but do not raise a
detection. Teams that use Vertex AI make these changes as part of normal work,
and no single change reliably separates misuse from use.

## Troubleshooting

### Warning: Wirespeed Cannot List Projects

The credentials are missing **Browser** (`roles/browser`) on the organization,
or the Cloud Resource Manager API is disabled in the credentials' project.
Grant the role at the organization level, then wait for the next permission
check.

### Warning: Wirespeed Cannot Read Cloud Logging

The credentials are missing **Logs Viewer** (`roles/logging.viewer`) on the
organization, or the Cloud Logging API is disabled in the credentials' project.
Grant the role at the organization level, then wait for the next permission
check.

### Quota Exceeded

A `429` error means the 60-requests-per-minute log read quota was used up,
often by other tools reading logs with the same project's credentials. Wirespeed
retries the same window on the next poll, so no logs are skipped.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.