Skip to content

Google Cloud Audit Logs source

This event source receives messages from Google Cloud Audit Logs by subscribing to a Google Cloud Pub/Sub topic.

With tmctl:

tmctl create source googlecloudauditlogs --serviceName <serviceName> --methodName <methodName> --pubsub.project = <project> --serviceAccountKey $(cat ./key.txt)

On Kubernetes:

kind: GoogleCloudAuditLogsSource
  name: sample
  methodName: google.pubsub.v1.Publisher.CreateTopic

    project: my-project
    # Alternatively, provide a pre-existing Pub/Sub topic:
    # topic: projects/my-project/topics/my-topic

    value: >-
        "type": "service_account",
        "project_id": "my-project",
        "private_key_id": "0000000000000000000000000000000000000000",
        "private_key": "-----BEGIN PRIVATE KEY-----\nMIIE...\n-----END PRIVATE KEY-----\n",
        "client_email": "",
        "client_id": "000000000000000000000",
        "auth_uri": "",
        "token_uri": "",
        "auth_provider_x509_cert_url": "",
        "client_x509_cert_url": ""
      kind: RedisBroker
      name: triggermesh

Events produced have the following attributes:

  • type

See the Kubernetes object reference for more details.


  • Service Name: The name of the API service performing the operation. For example, "".
  • Method Name: The name of the service method or operation. For API calls, this should be the name of the API method. For example, "google.pubsub.v1.Publisher.CreateTopic".
  • Resource Name (Optional): The resource or collection that is the target of the operation. The name is a scheme-less URI, not including the API service name. Google Cloud Audit Logs Types

Service Account

A Service Account is required to authenticate the event source and allow it to interact with Google Cloud Audit Logs.

The service account must be granted an IAM Role with at least the following permissions:

  • logging.sinks.get
  • logging.sinks.create
  • logging.sinks.delete

The following set of permissions is also required because this source delegates the management of the Pub/Sub subscription to the Pub/Sub Source.

  • pubsub.subscriptions.create
  • pubsub.subscriptions.delete

The predefined roles/logging.admin and roles/pubsub.editor roles are an example of roles that are suitable for use with the TriggerMesh event source for Google Cloud Audit Logs.

Create a key for this service account and save it. This key must be in JSON format. It is required to be able to run an instance of the Google Cloud Audit Logs event source.