Configuration of audit logs for JIT application is not working as expected.

[Rajeshwaric7]

@jpassing , I tried configuring it in 2 ways but have issues even though have setup email configuration properly.

1. using Google log based alert https://cloud.google.com/logging/docs/alerting/log-based-alerts : Created alert policy to query labels.event="api.activateRole" However logs are showing up in console but emails are not getting forwarded to our Team DL.

2. Using pub/sub and application Integration https://cloud.google.com/application-integration/docs/listen-pub-sub-topic-send-email Issue is emails are not getting forwarded to our Team DL but if i update our induvial ID's, receiving emails.

Please suggest the reliable solution for enabling this auditing.

[Rajeshwaric7]

@jpassing , Any suggestions on my ask.

[jpassing]

Re (1): When you open the Policy details page in the Cloud Console, do you see matching logs and any incidents?

When I set up an alerting policy for the query labels.event="api.activateRole" and activate a role in JIT Access, the page looks like this:

If you don't see logs, then maybe logs are being routed to a different project? If you see logs and incidents, but don't get any emails, then I suspect there's something wrong with the configuration of notification channels.