> ## Documentation Index
> Fetch the complete documentation index at: https://docs.omni.co/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Google Cloud Storage for Omni audit logs

> Configure Google Cloud Storage as the destination for your Omni audit logs to track user activity with structured event data.

<Note>
  Reach out to Omni support to have audit logs enabled for your instance.
</Note>

Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. Events included in logs are structured as JSON payloads and sent in batches to your cloud storage bucket a few minutes after they're written.

## Supported authentication methods

Audit logs can be delivered to a Google Cloud Storage (GCS) bucket using one of two authentication methods:

* **Workload Identity Federation** - Workload Identity Federation allows Omni's audit log delivery service to authenticate to your GCS bucket using AWS IAM credentials through GCP Workload Identity Federation.
  <Note>
    This is the recommended authentication method for GCS as it eliminates the need to manage long-lived service account keys.
  </Note>
* **Service account key** - This method uses a service account JSON key file for authentication. While straightforward, it requires managing long-lived credentials.

## Option 1: Workload Identity Federation

This approach provides enhanced security by:

* Eliminating the need to share or rotate service account keys
* Using temporary, automatically rotating credentials
* Leveraging your existing AWS and GCP IAM policies

### Requirements

* An existing GCS bucket where audit logs will be delivered
* Permissions to create and configure a Workload Identity Pool in your GCP project
* Permissions to create and configure a service account with write access to your GCS bucket

### Setup

Work with Omni support to configure Workload Identity Federation. The setup involves:

<Steps>
  <Step title="Get your Omni AWS details from Omni support" noAnchor>
    Omni support provides the AWS account ID and the AWS IAM role name that will authenticate to your GCS bucket.
  </Step>

  <Step title="Create a Workload Identity Pool" noAnchor>
    Create a [Workload Identity Pool and AWS provider](https://docs.cloud.google.com/iam/docs/workload-identity-federation-with-other-clouds#gcloud_1) in your GCP project. Use the AWS account ID from Omni support for the provider.
  </Step>

  <Step title="Create a GCP service account" noAnchor>
    Create a [GCP service account](https://docs.cloud.google.com/iam/docs/service-accounts-create) with write permissions (`objectCreator` role) to your GCS bucket.
  </Step>

  <Step title="Configure the Workload Identity Pool" noAnchor>
    Configure the Workload Identity Pool to allow the Omni AWS IAM role you received in step 1 to impersonate your GCP service account. Grant the `Workload Identity User` role on the service account to this principal:

    ```text theme={null}
    principalSet://iam.googleapis.com/projects/<PROJECT_NUMBER>/locations/global/workloadIdentityPools/<POOL_ID>/attribute.aws_role/arn:aws:sts::<OMNI_AWS_ACCOUNT_ID>:assumed-role/<OMNI_ROLE_NAME>
    ```

    Use your GCP project number, not the project ID.
  </Step>

  <Step title="Provide Omni with the connection details" noAnchor>
    Provide Omni support with the following:

    * GCS bucket name
    * Project number
    * Pool ID
    * Provider ID
    * Service account email
  </Step>

  <Step title="Complete setup with Omni support" noAnchor>
    Omni support completes the configuration on the Omni side. New audit logs arrive in your bucket a few minutes after your users take actions in Omni. Tell Omni support when you see files in your bucket.
  </Step>
</Steps>

Once configured, audit logs will be automatically delivered to your GCS bucket without requiring any credential management.

## Option 2: Service account key

This approach uses a service account JSON key file to authenticate to the GCS bucket.

<Note>
  The [Workload Identity Federation approach](#option-1-workload-identity-federation) is recommended over using a service account key.
</Note>

### Requirements

* An existing GCS bucket where audit logs will be delivered
* Permissions in GCS that allow you to create a service account key

### Setup

<Steps>
  <Step title="Create a service account key">
    Create a [service account key](https://docs.cloud.google.com/iam/docs/keys-create-delete) in GCS.
  </Step>

  <Step title="Provide Omni support with your bucket details" noAnchor>
    Provide Omni support with the name of your GCS bucket and the service account key you created in the previous step.
  </Step>

  <Step title="Complete setup with Omni support" noAnchor>
    Omni support completes the configuration on the Omni side.
  </Step>
</Steps>

Once configured, audit logs will be automatically delivered to your GCS bucket.

## Next steps

* Learn about the [event types](/administration/audit-logs/event-types) supported for audit logs
* Check out your instance's [Analytics section](/administration/analytics)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.