# Ensure Data Access Audit Logs are Enabled for Cloud Storage

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888291277280-ensure-data-access-audit-logs-are-enabled-for-cloud-storage
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Data Access audit logs are enabled for the Cloud Storage API so that read and write operations on object data (in addition to administrative activity) are recorded in Cloud Audit Logs.

**Rationale**

By default, Admin Activity audit logs are always enabled and capture configuration changes, but Data Access audit logs, which record who read or wrote which objects, are not enabled by default because of their potential volume. Without Data Access logs, investigators cannot determine who accessed or exfiltrated specific objects in a bucket, which significantly limits incident response and forensic capability for data stored in Cloud Storage.

**Impact**

-   Provides visibility into who read, wrote, or deleted specific objects in Cloud Storage buckets
    
-   Improves incident response and forensic investigation capability for data access events
    
-   Supports compliance requirements for auditing access to sensitive data
    
-   Increases log volume and associated Cloud Logging storage cost
    

**Default Value**

Data Access audit logs for Cloud Storage are disabled by default, except for the DATA\_WRITE log type for BigQuery, which is unrelated to this control.

**Pre-Requisites**

-   IAM permissions to view and edit IAM Audit Config (e.g., Project IAM Admin or Organization Policy Administrator)
    
-   Awareness of the additional logging cost from enabling Data Access logs
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Audit Logs.
    
4.  Locate Google Cloud Storage in the list of services.
    
5.  Verify that Admin Read, Data Read, and Data Write log types are all enabled (checked).
    
6.  If any Data Access log type is disabled for Cloud Storage, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Audit Logs.
    
4.  Locate Google Cloud Storage in the service list and select it.
    
5.  In the panel that appears, check Admin Read, Data Read, and Data Write.
    
6.  Click Save.
    
7.  Optionally configure exempted members if certain service accounts should be excluded from Data Access logging to control log volume.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to IAM & Admin > Audit Logs.
    
4.  Locate Google Cloud Storage and select it.
    
5.  Uncheck Data Read and/or Data Write as needed (Admin Activity logs cannot be disabled).
    
6.  Click Save.
    

**Reference**

-   [https://cloud.google.com/logging/docs/audit/configure-data-access](https://cloud.google.com/logging/docs/audit/configure-data-access)
    
-   [https://cloud.google.com/storage/docs/audit-logging](https://cloud.google.com/storage/docs/audit-logging)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.