Audit log streaming destination: Google Cloud Storage (GCS)
Naoya Matayoshi
Add Google Cloud Storage (GCS) as a first-class destination for CircleCI Cloud audit log streaming (Scale plan), alongside Amazon S3 / S3-compatible destinations.
Problem:
Audit log streaming today targets AWS S3, or other S3-compatible endpoints that support OIDC with STS-style AssumeRoleWithWebIdentity. Many enterprise security teams run GCP-native SecOps (Chronicle, GCS-backed pipelines) and cannot assume that role flow against a plain GCS bucket. The documented workaround is to stream to S3 first, then forward (for example S3 → SQS → Google), which adds AWS cost, complexity, and a second cloud dependency for GCP-only customers.
Use cases:
- GCP-centric orgs that want CircleCI audit events in GCS / Chronicle without an S3 hop
- Compliance teams that require audit data to land in a GCP-controlled bucket
- Reducing multi-cloud glue for customers already standardized on GCS
Workarounds today:
- Stream to AWS S3 (or a true STS-compatible S3 API), then forward into GCP
- Manual / self-serve audit log requests from the UI (not continuous streaming)