2

I am trying to find a gcloud command that can provide information about the creator of an instance. Is there a way to achieve that?

Thank you.

Aldo Andrade
  • 51
  • 5
Yonatan Brand
  • 781
  • 3
  • 11

2 Answers2

1

My suggestion would be executing gcloud logging read, in particular gcloud logging read "resource.type=gce_instance".

You should be able to see a field called authenticationInfo which contains the email address of who did a certain operation. In this case, you have to look for the method field that has the valuecompute.instances.insert if I recall correctly.

Mangu
  • 3,160
  • 2
  • 25
  • 42
1

Yes, See below and replace the [instance name] accordingly.

gcloud logging read "resource.type=gce_instance AND jsonPayload.event_subtype=compute.instances.insert AND jsonPayload
.resource.name=[instance name]" | grep user
Alioua
  • 1,663
  • 1
  • 9
  • 18