Glossary term
Data Access audit logs
Cloud Audit Logs recording reads of configuration and data (ADMIN_READ, DATA_READ) and data writes (DATA_WRITE). Off by default except some BigQuery services.
Data Access audit logs (cloudaudit.googleapis.com/data_access) record API calls that read resource configuration (ADMIN_READ), read user data (DATA_READ) or write user data (DATA_WRITE): for example storage.objects.get, secret access, GetIamPolicy, or GenerateAccessToken on the IAM Credentials API.
They are disabled by default for all services except some BigQuery services, are enabled through auditConfigs in the IAM policy, and land in the _Default bucket (30 days by default). Without them, an investigation cannot say which data was read. Removing an audit config is itself logged as an Admin Activity SetIamPolicy.
See GCP Data Access logs: off by default, and other blind spots and Google's configuration guide.