GCP projects should have Data Access audit logs enabled for Cloud Storage
Data Access audit logs (DATA_READ and DATA_WRITE) are enabled for Cloud Storage at the project level. Unlike Admin Activity logs (enabled by default), Data Access logs must be explicitly configured to track read and write operations on Cloud Storage objects.
Without Data Access audit logs, you cannot track who accessed or modified objects in your Cloud Storage buckets, making it difficult to detect unauthorized access, data exfiltration, or compliance violations.
What this control checks
Data Access audit logs (DATA_READ and DATA_WRITE) are enabled for Cloud Storage at the project.
Common pitfalls
Data Access logs must be explicitly configured
Unlike Admin Activity logs (enabled by default), Data Access logs must be explicitly configured to track read and write operations on Cloud Storage objects.
Project-level setting for all buckets
This is a project-level setting that applies to all Cloud Storage buckets in the project.
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_audit_logs_enabled (prowler gcp --checks cloudstorage_audit_logs_enabled).
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_cloudstorage_audit_logs_enabled - Prowler Check:
cloudstorage_audit_logs_enabled
Last reviewed: 2026-10-09