I am trying to trigger a Cloud Run service by uploading a file to a Google Cloud Storage bucket. To do so, an Eventarc trigger was created via Terraform, which filters for storage.objects.create event from the Audit Logs. Google has documentation on this exact topic: here
Even though the audit log is correctly recorded, the event is not getting fired (no activity from Eventarc, Pub/Sub, and Cloud Run). I am not sure where else to look.
My question is: Can I still achieve this using Audit Log triggers without relying on direct triggers (e.g., google.cloud.storage.object.v1.finalized)?
Truncated output of gcloud eventarc triggers describe:
destination:
cloudRun:
region: us-east4
service: <SERVICE_NAME>
eventFilters:
- attribute: serviceName
value: storage.googleapis.com
- attribute: type
value: google.cloud.audit.log.v1.written
- attribute: methodName
value: storage.objects.create
name: projects/<PROJECT>/locations/us-east4/triggers/<TRIGGER_NAME>
serviceAccount: <COMPUTE_ENGINE_DEFAULT_SERVICE_ACCOUNT>
transport:
pubsub:
subscription: projects/<PROJECT>/subscriptions/eventarc-us-east4-<TRIGGER_NAME>-sub-279
topic: projects/<PROJECT>/topics/eventarc-us-east4-<TRIGGER_NAME>-401
Truncated output of gcloud logging read "protoPayload.methodName=storage.objects.create" --format=json:
{
"logName": "projects/<PROJECT>/logs/cloudaudit.googleapis.com%2Fdata_access",
"protoPayload": {
"@type": "type.googleapis.com/google.cloud.audit.AuditLog",
"methodName": "storage.objects.create",
"resourceName": "projects/_/buckets/<BUCKET>/objects/<BLOB>",
"serviceData": {
"@type": "type.googleapis.com/google.iam.v1.logging.AuditData",
"policyDelta": {}
},
"serviceName": "storage.googleapis.com",
"status": {}
},
"resource": {
"labels": {
"bucket_name": "<BUCKET>",
"project_id": "<PROJECT>"
},
"type": "gcs_bucket"
},
"severity": "INFO",
}
Finally, how I'm creating the Eventarc Trigger with Terraform:
resource "google_eventarc_trigger" "cloud_run_trigger" {
name = "<TRIGGER_NAME>"
matching_criteria {
attribute = "type"
value = "google.cloud.audit.log.v1.written"
}
matching_criteria {
attribute = "serviceName"
value = "storage.googleapis.com"
}
matching_criteria {
attribute = "methodName"
value = "storage.objects.create"
}
destination {
cloud_run_service {
service = google_cloud_run_service.default.name
}
}
}
I've done everything I can to follow Google's documentation & filter for correct Audit Log based on serviceName and methodName. The entire project is silent when the event is logged, which seems like the event is not firing for some reason. I do not observe any activity in Cloud Run, Eventarc, and Pub/Sub.
