Skip to main content
Reach out to Omni support to have audit logs enabled for your instance.
Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. Events included in logs are structured as JSON payloads and sent in batches to your cloud storage bucket a few minutes after they’re written.
With Google Cloud Storage, Omni writes logs directly to a bucket you own. Changes on your side, such as removing the service account’s access to the bucket or deleting its key, stop delivery until they’re fixed. If you can use Amazon S3, we recommend it, because the logs are stored in a bucket Omni manages.

​
Supported authentication methods

Audit logs can be delivered to a Google Cloud Storage (GCS) bucket using one of two authentication methods:
  • Workload Identity Federation - Workload Identity Federation allows Omni’s audit log delivery service to authenticate to your GCS bucket using AWS IAM credentials through GCP Workload Identity Federation.
    This is the recommended authentication method for GCS as it eliminates the need to manage long-lived service account keys.
  • Service account key - This method uses a service account JSON key file for authentication. While straightforward, it requires managing long-lived credentials.

​
Option 1: Workload Identity Federation

This approach provides enhanced security by:
  • Eliminating the need to share or rotate service account keys
  • Using temporary, automatically rotating credentials
  • Leveraging your existing AWS and GCP IAM policies

​
Requirements

  • An existing GCS bucket where audit logs will be delivered
  • Permissions to create and configure a Workload Identity Pool in your GCP project
  • Permissions to create and configure a service account with write access to your GCS bucket

​
Setup

Work with Omni support to configure Workload Identity Federation. The setup involves:
1

Get your Omni AWS details from Omni support

Omni support provides the AWS account ID and the AWS IAM role name that will authenticate to your GCS bucket.
2

Create a Workload Identity Pool

Create a Workload Identity Pool and AWS provider in your GCP project. Use the AWS account ID from Omni support for the provider.
3

Create a GCP service account

Create a GCP service account with write permissions (objectCreator role) to your GCS bucket.
4

Configure the Workload Identity Pool

Configure the Workload Identity Pool to allow the Omni AWS IAM role you received in step 1 to impersonate your GCP service account. Grant the Workload Identity User role on the service account to this principal:
Use your GCP project number, not the project ID.
5

Provide Omni with the connection details

Provide Omni support with the following:
  • GCS bucket name
  • Project number
  • Pool ID
  • Provider ID
  • Service account email
6

Complete setup with Omni support

Omni support completes the configuration on the Omni side. New audit logs arrive in your bucket a few minutes after your users take actions in Omni. Tell Omni support when you see files in your bucket.
Once configured, audit logs will be automatically delivered to your GCS bucket without requiring any credential management.

​
Option 2: Service account key

This approach uses a service account JSON key file to authenticate to the GCS bucket.
The Workload Identity Federation approach is recommended over using a service account key.

​
Requirements

  • An existing GCS bucket where audit logs will be delivered
  • Permissions in GCS that allow you to create a service account key

​
Setup

1

Create a service account key

Create a service account key for a service account that has write access to the bucket.
2

Provide Omni support with your bucket details

Provide Omni support with the name of your GCS bucket and the service account key you created in the previous step.Don’t paste the key into a ticket or email. Reach out to Omni support to find out how to share it securely.
3

Complete setup with Omni support

Omni support completes the configuration on the Omni side.
Once configured, audit logs will be automatically delivered to your GCS bucket.

​
Next steps