Glossary term
Admin Activity audit logs
The Cloud Audit Logs type recording API calls that change configuration or metadata. Always on, cannot be disabled, kept 400 days in the _Required bucket.
Admin Activity audit logs (cloudaudit.googleapis.com/activity) record user-driven API calls that modify the configuration or metadata of resources: IAM policy changes (SetIamPolicy), service account key creation, VM creation and metadata changes, firewall rules, log sinks.
They are always written, cannot be disabled, and are routed to the _Required log bucket, which keeps them 400 days and whose sink cannot be modified or deleted. That makes them the most reliable evidence in a Google Cloud incident: even an attacker with Owner rights cannot erase them from the project. They record changes, not reads; reads are in Data Access audit logs.