> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Cloud

> Connect your Google Cloud account so Sazabi can provision a Cloud Logging sink, Pub/Sub topic, and pull subscription for each project, folder, or organization you select.

[All Google Cloud integration capabilities](https://docs.sazabi.com/catalogs/integrations/google-cloud)

## About

Google Cloud logs flow through Pub/Sub: a Cloud Logging sink routes log entries to a Pub/Sub topic, and a pull subscription feeds Sazabi. Connecting your GCP account lets Sazabi set up that entire pipeline — sink, topic, and subscription — in your project automatically, using a service account key you provide.

Each project stream forwards every log entry in that project, its Cloud Audit Logs included. To collect Cloud Audit Logs from every project in an organization or folder, add an organization or folder stream instead; see [Cloud Audit Logs for an organization or folder](#cloud-audit-logs-for-an-organization-or-folder).

Google Cloud also has a **Send to an endpoint** path where you create the sink, topic, and subscription yourself and run your own OpenTelemetry Collector. See [Google Cloud endpoint page](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/gcp.md) for that setup.

> [!WARNING]
>
> GCP bills for Pub/Sub message delivery (and any egress); Sazabi does not. High-volume log projects can incur meaningful Pub/Sub costs on your GCP bill. Use log sink filters to forward only the logs you need. See [Pub/Sub pricing](https://cloud.google.com/pubsub/pricing).

## Prerequisites

* A GCP service account with the following IAM roles on each target project:
  * `roles/serviceusage.serviceUsageAdmin`
  * `roles/logging.configWriter`
  * `roles/pubsub.admin`
  * `roles/browser`
* Permission to create a service account key (JSON format) for that service account.
* The Service Usage API enabled on the project. Sazabi uses this API to enable the others, but it cannot enable itself — if it is disabled, enable it manually and wait about a minute before retrying.

> [!WARNING]
>
> If your organization enforces a **Domain Restricted Sharing** org policy (`iam.allowedPolicyMemberDomains`), an Organization Policy Administrator must relax it for the target project before Sazabi can grant the Cloud Logging sink's writer identity access to Pub/Sub. Without this, the log stream setup fails at the final step.

## Set up in the dashboard

**Step 1**

### Grant the service account IAM roles

In the [Google Cloud Console](https://console.cloud.google.com/iam-admin/serviceaccounts), select or create a service account and grant it the four roles listed in Prerequisites on the target project.

Enable the [Service Usage API](https://console.cloud.google.com/apis/library/serviceusage.googleapis.com) on the project if it is not already enabled.

**Step 2**

### Create and download a service account key

In the Google Cloud Console, open the service account, go to the **Keys** tab, and choose **Add key > Create new key > JSON**. Download the JSON file.

Alternatively, using the gcloud CLI:

```bash theme={"system"}
gcloud iam service-accounts keys create sazabi-key.json \
  --iam-account=YOUR_SERVICE_ACCOUNT_EMAIL
```

**Step 3**

### Connect in Sazabi

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, and select **Google Cloud**. Select **Service account** as the setup method. Paste the contents of the service account key JSON file into the key field, then click **Connect**.

Sazabi enables the required APIs and verifies access by listing projects accessible to the service account.

**Step 4**

### Add log streams

After the connection is confirmed, click **Add log stream** to open the stream picker. Sazabi lists all active GCP projects accessible to the service account, plus any organizations and folders it can view as **Organization audit logs** or **Folder audit logs** rows. Select the ones you want to forward. For each, Sazabi creates a Pub/Sub topic, a Cloud Logging sink, and a pull subscription automatically.

### Cloud Audit Logs for an organization or folder

An organization or folder stream creates one [aggregated sink](https://cloud.google.com/logging/docs/export/aggregated_sinks) on the organization or folder. The sink includes every child project, routes only [Cloud Audit Logs](https://cloud.google.com/logging/docs/audit) (Admin Activity, Data Access, System Event, and Policy Denied), and doesn't intercept them, so the projects' own sinks keep receiving their copies. Its Pub/Sub topic and pull subscription live in the service account's own project.

**Step 1**

### Grant organization or folder roles

In addition to the project roles in Prerequisites, grant the service account these roles on the organization or folder:

* `roles/logging.configWriter`, to create the sink
* `roles/resourcemanager.organizationViewer` on an organization, or `roles/resourcemanager.folderViewer` on a folder, so it appears in the stream picker

For example, for an organization:

```bash theme={"system"}
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
  --role="roles/logging.configWriter"
gcloud organizations add-iam-policy-binding ORGANIZATION_ID \
  --member="serviceAccount:SERVICE_ACCOUNT_EMAIL" \
  --role="roles/resourcemanager.organizationViewer"
```

**Step 2**

### Choose which audit logs to collect

Admin Activity, System Event, and Policy Denied audit logs are on by default. Data Access audit logs are off by default (except BigQuery). To collect them, [turn them on](https://cloud.google.com/logging/docs/audit/configure-data-access) under **IAM & Admin > Audit Logs** for the organization or folder, only for the services you need.

**Step 3**

### Add the stream

Click **Add log stream** and select the organization's or folder's audit logs row.

> [!WARNING]
>
> Data Access audit logs can be very high volume. Their Cloud Logging and Pub/Sub costs land on your GCP bill. If you also have project streams under the same organization or folder, Sazabi receives those projects' audit log entries from both streams.

Each audit log entry's service is its `protoPayload.serviceName`, and these fields are searchable log attributes:

| Attribute | Audit log field |
| - | - |
| `gcp.audit.method_name` | `protoPayload.methodName` |
| `gcp.audit.principal_email` | `protoPayload.authenticationInfo.principalEmail` |
| `gcp.audit.resource_name` | `protoPayload.resourceName` |
| `gcp.audit.caller_ip` | `protoPayload.requestMetadata.callerIp` |
| `gcp.audit.user_agent` | `protoPayload.requestMetadata.callerSuppliedUserAgent` |
| `gcp.audit.authorization_granted` | `protoPayload.authorizationInfo[0].granted` |
| `gcp.audit.status_code` | `protoPayload.status.code` |
| `gcp.audit.service_name` | `protoPayload.serviceName` |
| `gcp.log_name` | `logName` (its last part names the audit log type) |
| `gcp.insert_id` | `insertId` |

## Set up with the CLI

You can also connect the Google Cloud log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

Create a native connection by passing the downloaded service account key JSON as the `serviceAccountKey` metadata field. Load the key file into the metadata so the JSON is embedded as a string:

```bash theme={"system"}
sazabi log-sources create gcp --mode native \
  --metadata "$(jq -n --rawfile k /path/to/service-account-key.json '{serviceAccountKey: $k}')"
```

Sazabi validates the service account credentials against Google Cloud and creates the log source; note the log source ID it prints.

Add a log stream — one per GCP project — with `sazabi log-streams create`, passing the GCP project ID in `--config`:

```bash theme={"system"}
sazabi log-streams create --log-source-id <log-source-id> \
  --config '{"gcpProjectId":"<your GCP project ID>"}'
```

For an organization or folder Cloud Audit Logs stream, set `scope` and the organization or folder ID. `gcpProjectId` is the service account's own project, which holds the Pub/Sub topic and subscription. `auditLogTypes` is optional and defaults to all four (`activity`, `data_access`, `system_event`, `policy`):

```bash theme={"system"}
sazabi log-streams create --log-source-id <log-source-id> \
  --config '{"scope":"organization","gcpOrganizationId":"<organization ID>","gcpProjectId":"<service account project ID>","auditLogTypes":["activity","system_event","policy"]}'
```

Use `"scope":"folder"` with `"gcpFolderId"` for a folder.

Run `sazabi log-sources list` to confirm the source and its streams.

## Verify

Write a test log entry in a connected GCP project — for example invoke a Cloud Function or deploy to Cloud Run.

Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm records attributed to the **Google Cloud** source appear. Logs travel through Cloud Logging and Pub/Sub, so they typically appear within a few minutes of the log event.

## Troubleshooting

**"Service account cannot access any active GCP projects"** — Verify the service account has `roles/browser` on at least one project, and that the service account key JSON was pasted in full without truncation.

**"Service Usage API has not been used / is disabled"** — Enable the Service Usage API in the [Google Cloud Console](https://console.cloud.google.com/apis/library/serviceusage.googleapis.com) for the project, wait about a minute, then retry the connection.

**Log stream setup fails at the final step** — Your organization likely has a Domain Restricted Sharing org policy (`iam.allowedPolicyMemberDomains`). An Organization Policy Administrator must relax the policy for the project so Sazabi can grant the Cloud Logging sink's writer identity access to the Pub/Sub topic.

**An organization or folder is missing from the stream picker** — Grant the service account `roles/resourcemanager.organizationViewer` (or `roles/resourcemanager.folderViewer`) on it, wait about a minute, then reopen the picker.

**"The service account can't create a log sink on this organization"** — Grant the service account `roles/logging.configWriter` on the organization or folder itself; the project role doesn't cover it.

**GCP metrics and traces are not supported** — This log source covers Cloud Logging entries only. Cloud Monitoring metrics and traces are not forwarded.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [Google Cloud (send to an endpoint)](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/gcp.md)
>
> Run your own OpenTelemetry Collector against a Pub/Sub subscription.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.

> [card] [Send Kubernetes audit logs](https://docs.sazabi.com/guides/instrument/kubernetes-audit-logs.md)
>
> Send GKE audit logs through this source.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.