You need to verify that a Google Cloud Platform service account was created at a particular time. What should you do?

Creating a Google Cloud service account is an administrative action that modifies the configuration of a project's Identity and Access Management (IAM) resources. According to Google Cloud's audit logging policy, such administrative modifications are captured in Admin Activity audit logs. In the Google Cloud Console's log viewer, Admin Activity logs are categorized under Configuration. To isolate the specific event, you must filter by the resource that was modified, which in this case is the Service Account resource type. This combination provides the most precise filter to find the creation event.

B. Filtering by "Google Project" as the resource type is too broad. This would display all configuration changes for the entire project, making it difficult to locate the specific service account creation event.
C. The "Data Access" category is incorrect. These logs record API calls that read configuration/metadata or read/write user data, not administrative actions like creating a service account.
D. This option is incorrect for two reasons: the "Data Access" category is inappropriate for this administrative action, and filtering by "Google Project" is too broad and inefficient.

1. Google Cloud Documentation - Cloud Audit Logs Overview: This document distinguishes between different types of audit logs. It states

"Admin Activity audit logs contain log entries for API calls or other actions that modify the configuration or metadata of resources." This supports using the "Configuration" (Admin Activity) category.

Source: Google Cloud Documentation > Cloud Audit Logs > Overview > "Types of audit logs".

2. Google Cloud Documentation - IAM Audit Logging: This page details which IAM actions generate which types of logs. The google.iam.admin.v1.IAM.CreateServiceAccount method is explicitly listed as an action that generates an Admin Activity audit log.

Source: Google Cloud Documentation > IAM > Documentation > Guides > "Audit logging" > "Audited operations".

3. Google Cloud Documentation - View logs by using the Logs Explorer: This guide demonstrates how to build queries in the Logs Explorer. It shows the ability to filter by resource.type. The resource type for a service account is iamserviceaccount

which corresponds to the "Service Account" filter in the UI.

Source: Google Cloud Documentation > Cloud Logging > Documentation > "View logs by using the Logs Explorer" > "Build queries".