12 · EN
Glossary
Plain-language definitions of the Google Cloud logging, IAM and incident-response terms used across the tool and the blog.
A
- Admin Activity audit logs
- The Cloud Audit Logs type recording API calls that change configuration or metadata. Always on, cannot be disabled, kept 400 days in the _Required bucket.
- allUsers and allAuthenticatedUsers
- Special IAM principals meaning anyone on the Internet (allUsers) or anyone signed in to a Google account (allAuthenticatedUsers). They make resources public.
C
- Cloud Audit Logs
- Google Cloud's record of who did what, where and when on the control plane: Admin Activity, Data Access, System Event and Policy Denied audit logs.
D
- Data Access audit logs
- Cloud Audit Logs recording reads of configuration and data (ADMIN_READ, DATA_READ) and data writes (DATA_WRITE). Off by default except some BigQuery services.
I
- IAM policy (allow policy)
- The set of role bindings attached to a Google Cloud resource: who (members) has which role. Changed with SetIamPolicy and logged as bindingDeltas in audit logs.
L
- Log sink
- A Cloud Logging routing rule sending matching entries to a log bucket, Cloud Storage, BigQuery, Pub/Sub or another project. Deleting one blinds defenders.
O
- OS Login
- Compute Engine feature tying SSH access to IAM identities instead of metadata SSH keys. Enabled with enable-oslogin=TRUE; disabling it lets injected keys work.
S
- Service account impersonation
- A principal obtaining short-lived credentials for a Google Cloud service account through the IAM Credentials API instead of a key. Logged with delegation info.
- Service account key
- A user-managed key pair letting anyone who holds the private key (usually a JSON file) authenticate as a Google Cloud service account from anywhere.
- Service account
- A non-human Google Cloud identity used by workloads such as VMs, CI pipelines and functions. Its email ends in gserviceaccount.com; it holds IAM roles.
- Startup script (Compute Engine)
- A Compute Engine metadata value (startup-script, startup-script-url) that runs as root on Linux at every boot. Changing it is a persistence technique.
V
- VPC Flow Logs
- Sampled network flow records for Google Cloud VPC subnets: IPs, ports, protocol, estimated bytes and packets. No payload; only where enabled beforehand.