Google Cloud Logging API - Missing authentication(user) information from audit logs for certain log entries

Question

Google Cloud Logging API currently provides audit logs for App Engine, BigQuery, and Cloud Dataflow. According to Google docs, authentication information field of an Audit Log entry contains email address of the user that performed the actual operation. But this field is empty for certain log entries of type app engine and bigquery. Is there a documentation that gives the list of activities which doesn't provide the authentcationInfo in the API response.

Answer 1

For App Engine, identity information is not captured for logs coming from the legacy App Engine API.

For BigQuery, identity information is currently redacted from the logs unless:

1. the user is a service account
2. the user is a member of the authorized domain associated with the project
3. the user has permission to run queries in the project and the action is either administrative or job.insert

The docs have been updated to reflect this.