Receive a Cloud Audit Logs event

Console

1. In the Google Cloud console, go to the Repositories page.
   

   Go to Repositories

2. Click add Create repository.
3. Configure your repository:
   1. Enter a unique Name.
   2. For Format, choose Docker.
   3. For Mode, choose Standard.
   4. For Location type, choose Region.
   5. In the Region list, select us-central1 (Iowa).
4. Accept the other defaults and click Create.

gcloud

gcloud artifacts repositories create REPOSITORY \
    --repository-format=docker \
    --location=$REGION

Replace REPOSITORY with a unique name for the Artifact Registry repository.

Console

1. In the Google Cloud console, go to the Buckets page.
   

   Go to Buckets

2. Click add Create bucket.
3. Enter your bucket information and click Continue to complete each step:
   1. Enter a unique Name. For example, eventarcbucket.
   2. Select Region as the Location Type.
   3. Select us-central1 (Iowa) as the Location.
   4. Select Standard for default storage class.
   5. Select Uniform for Access control.
4. Click Create.

gcloud

gcloud storage buckets create gs://events-tutorial-PROJECT_ID/ --location=$REGION

Console

1. Clone the sample repository to your GitHub account:

Go

1. On GitHub, navigate to GoogleCloudPlatform/golang-samples
2. Click Fork.

3. If prompted, select the location where you want to fork the repository.

Java

1. On GitHub, navigate to GoogleCloudPlatform/java-docs-samples.
2. Click Fork.

3. If prompted, select the location where you want to fork the repository.

.NET

1. On GitHub, navigate to GoogleCloudPlatform/dotnet-docs-samples.
2. Click Fork.

3. If prompted, select the location where you want to fork the repository.

Node.js

1. On GitHub, navigate to GoogleCloudPlatform/nodejs-docs-samples.
2. Click Fork.

3. If prompted, select the location where you want to fork the repository.

Python

1. On GitHub, navigate to GoogleCloudPlatform/python-docs-samples.
2. Click Fork.

3. If prompted, select the location where you want to fork the repository.
2. In the Google Cloud console, go to the Services page.

Go to Services

3. Click add Create service to display the Create service form.
4. Select Continuously deploy from a repository.

   Changes to your GitHub repository are automatically built into container images in Artifact Registry and deployed to Cloud Run.

5. Click Set up with Cloud Build to open the Set up with Cloud Build form.
1. If prompted, enable the Cloud Build API and Artifact Analysis API.
2. Select GitHub as the Repository Provider.
3. If prompted, click Install Google Cloud Build.
4. Select the GitHub repository you forked as the Repository.
5. Click Next.
6. In the Branch field, enter ^main$.
7. Select Dockerfile as the Build Type and provide the source location of the Dockerfile:
   • eventarc/audit-storage/Dockerfile

     or

   • eventarc/audit_storage/Dockerfile(Go)
8. Click Save.
6. In the Create service form, enter a service name. For example, helloworld-events.
7. Select us-central1(Iowa) as the Region where you want your service located.
8. Select any of the Ingress options based on the ingress traffic you want to allow on the Cloud Run service.
9. Select Require authentication
10. Click Create.

gcloud

1. Clone the GitHub repository:

   Go

   git clone https://github.com/GoogleCloudPlatform/golang-samples.git
   cd golang-samples/eventarc/audit_storage
   

   Java

   git clone https://github.com/GoogleCloudPlatform/java-docs-samples.git
   cd java-docs-samples/eventarc/audit-storage

   .NET

   git clone https://github.com/GoogleCloudPlatform/dotnet-docs-samples.git
   cd dotnet-docs-samples/eventarc/audit-storage

   Node.js

   git clone https://github.com/GoogleCloudPlatform/nodejs-docs-samples.git
   cd nodejs-docs-samples/eventarc/audit-storage

   Python

   git clone https://github.com/GoogleCloudPlatform/python-docs-samples.git
   cd python-docs-samples/eventarc/audit-storage

2. Build the container and upload it to Cloud Build:

   gcloud builds submit --tag $REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/$SERVICE_NAME:v1
   

3. Deploy the container image to Cloud Run:

   gcloud run deploy $SERVICE_NAME \
       --image $REGION-docker.pkg.dev/PROJECT_ID/REPOSITORY/$SERVICE_NAME:v1
   

   At the prompt to allow unauthenticated invocations, enter n.

   When the deployment succeeds, the command line displays the service URL.

Now that you have deployed your event receiver service called helloworld-events to Cloud Run, you can set up your trigger.

Console

1. In the Google Cloud console, go to the Triggers page.

   Go to Triggers

2. Click add_box Create trigger.
3. Type a Trigger name.

   This is the ID of the trigger and it must start with a letter. It can contain up to 63 lowercase letters, numbers, or hyphens.

4. Select a Trigger type:
   • First-party: Filters events sent from Google Cloud providers (directly or through Cloud Audit Logs entries) or providers using Pub/Sub messages.
   • Third-party: Filters events sent from third-party providers.
5. In the Event provider list, select Cloud Storage as the source of events.
6. In the Event type list, select storage.objects.create.
7. In the Region list, select us-central1 as the region to receive events from.
8. Select the Service account you created. For example, SERVICE_ACCOUNT_ID@PROJECT_ID.iam.gserviceaccount.com.
9. In the Event destination list, select Cloud Run.
10. In the Select a Cloud Run service list, select helloworld-events.
11. Click Create.
Note that you can also create an Eventarc trigger using the Cloud Run console page.

gcloud

1. Create a trigger that filters Cloud Storage events and that uses the service account you created:

   gcloud eventarc triggers create events-tutorial-trigger \
       --destination-run-service=$SERVICE_NAME \
       --destination-run-region=$REGION \
       --event-filters="type=google.cloud.audit.log.v1.written" \
       --event-filters="serviceName=storage.googleapis.com" \
       --event-filters="methodName=storage.objects.create" \
       --service-account=sample-service-account@PROJECT_ID.iam.gserviceaccount.com

   Replace PROJECT_ID with the Google Cloud project ID.

   Where:

   • type: specifies that audit logs are created when the trigger's filter criteria is met.
   • serviceName: the service that writes the audit log, which is Cloud Storage.
   • methodName: the operation that is being audited, which is storage.objects.create.
   This creates a trigger called events-tutorial-trigger.
2. To confirm events-tutorial-trigger was successfully created, run:

   gcloud eventarc triggers list --location=$REGION

The trigger, events-tutorial-trigger, is listed with a target of helloworld-events.