Solved: Notifications for metadata changes (SSH keys) - Page 2

gdsotirov · 11-30-2022 06:53 AM

Hello,

Is there a way to get notified (email, SMS, etc.) for metadata changes on project level (e.g. SSH keys)?

Regards,

--

Georgi

gdsotirov

I was able to achieve it with a logs based alert having the following filter:

resource.type="gce_project"
protoPayload.@type="type.googleapis.com/google.cloud.audit.AuditLog"
(	protoPayload.metadata.projectMetadataDelta.addedMetadataKeys!=""
	OR protoPayload.metadata.projectMetadataDelta.deletedMetadataKeys!=""
	OR protoPayload.metadata.projectMetadataDelta.modifiedMetadataKeys!=""
)

Note: The fields addedMetadataKeys, deletedMetadataKeys and modifiedMetadataKeys seem to have been added earlier this year.

But I'll have to fine tune the alert now, because it does not provide information about what was done and what was changed. It should be possible with labels.

View solution in original post