GCP: how can i find in Cloud Logging permission / role changes for a specific user?

Question

Which filter / query do I have to use in Cloud Logging to find role / permission changes for a specific user or service account?

Answer 1

You can use the following query settings in Cloud Logging to find role/permission changes for a specific user:

resource.type="project" AND
log_id("cloudaudit.googleapis.com/activity") AND
protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.bindingDeltas.member="user:FILL_IN_EMAIL_ADDRESS_OF_USER"

When you are looking for role / permission changes of a service account, you have to change the last line into:

protoPayload.serviceData.policyDelta.bindingDeltas.member="serviceAccount:FILL_IN_EMAIL_ADDRESS_OF_SERVICEACCOUNT"

The logs are quite extensive, but you find the actual iam changes under:
protoPayload -> serviceData -> policyDelta -> bindingDeltas

This also works by the way, but it is slower:

protoPayload.authorizationInfo.permission="resourcemanager.projects.setIamPolicy"
protoPayload.response.bindings.members="user:FILL_IN_EMAIL_ADDRESS_OF_USER"
protoPayload.serviceData.policyDelta.bindingDeltas.member="user:FILL_IN_EMAIL_ADDRESS_OF_USER"

This pointed me in the right direction:
https://serverfault.com/questions/1033795/how-to-find-out-who-added-a-user-or-modified-iam-roles-of-a-specific-user-in-gcp