Organization activity log data reference

Prior reading: Billing actions

Purpose: This document explains the various access-related actions Org Admins can take in Workbench.

Note: This document is specific to Org Admins only. Organization activity logs are Google Cloud Platform-specific.

Introduction

BigQuery contains per-organization isolated tables allowing Organization Admins to query org-specific data. Note that Org Admins have IAM access only to their own organization's tables.

Cloud audit logs dataset (workbench_cloud_audit_logs_prod)

Tables: cloud_audit_logs (unified) and per-org isolated tables cloud_audit_logs_<org_ufid>

Purpose: Tracks every data plane access event (e.g., when users read files from Google Cloud Storage (GCS), run BigQuery queries, or access BigQuery Storage API).

Scope: Includes events from both workspaces and data collections (i.e., any Google Cloud Platform (GCP) project linked to a workspace in the org).

cloud_audit_logs and cloud_audit_logs<org_ufid> tables

Schema

audit_log details (JSON)

The audit_log field contains the complete GCP Data Access audit log entry. Some key fields are listed below:

Event types captured

Can Org Admins see which files are being used?

Yes. The resourceName field in audit_log contains the complete object path, including the bucket name and full file path. For example:

• projects/_/buckets/vwb-aou-datasets-controlled/objects/v8/wgs/short_read/snpindel/vds/hail.vds/variant_data/rows/rows/parts/part-001663
• projects/_/buckets/vwb-aou-allxall/objects/v8/ht/ACAF_deprecated/EUR/phenotype_NS_324.311_ACAF_results.ht/index/part-1078-...

Example queries

Files accessed in a workspace

SELECT
  timestamp,
  user_email,
  workspace_user_facing_id,
  JSON_VALUE(audit_log, '$.methodName') AS method,
  JSON_VALUE(audit_log, '$.resourceName') AS resource_path,
  JSON_VALUE(audit_log, '$.requestMetadata.callerSuppliedUserAgent') AS client_tool
FROM `workbench-bq-log-sink.workbench_cloud_audit_logs_prod.cloud_audit_logs_<org_ufid>`
WHERE timestamp >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
  AND JSON_VALUE(audit_log, '$.serviceName') = 'storage.googleapis.com'
ORDER BY timestamp DESC
LIMIT 100

BigQuery queries run by users

SELECT
  timestamp,
  user_email,
  workspace_user_facing_id,
  JSON_VALUE(audit_log, '$.resourceName') AS query_resource
FROM `workbench-bq-log-sink.workbench_cloud_audit_logs_prod.cloud_audit_logs_<org_ufid>`
WHERE timestamp >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 7 DAY)
  AND JSON_VALUE(audit_log, '$.serviceName') = 'bigquery.googleapis.com'
ORDER BY timestamp DESC

Workspace activity logs dataset (workbench_monitoring_org_logs_prod)

wsm_workspace_activity_logs table

Per-org isolated tables: wsm_workspace_activity_logs_<org_ufid>

Purpose: Tracks workspace-level mutations (e.g., resource creation, deletion, cloning, role grants, and configuration changes).

Scope: Includes both workspaces and data collections. Use is_data_collection = TRUE to filter to data collections only.

Schema

Change types

Example queries

Who created workspaces

SELECT
  change_date,
  actor_email,
  workspace_user_facing_id,
  change_subject_type
FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.wsm_workspace_activity_logs_<org_ufid>`
WHERE change_type = 'CREATE' AND change_subject_type = 'WORKSPACE'
ORDER BY change_date DESC

Role grants on workspaces

SELECT
  change_date,
  actor_email,
  change_subject_id AS granted_to,
  workspace_user_facing_id
FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.wsm_workspace_activity_logs_<org_ufid>`
WHERE change_type = 'GRANT_WORKSPACE_ROLE'
ORDER BY change_date DESC

Notes on Role Grants

• Role is in properties JSON: GRANT_WORKSPACE_ROLE events store the granted role in the properties column as JSON (e.g., {"role": "reader"}). Extract with JSON_VALUE(properties, '$.role').
• Both user and group grants are logged: When a group is granted a workspace role, change_subject_type = 'GROUP' and change_subject_id is the group email.

workspace_policy_grants table

Per-org isolated tables: workspace_policy_grants_<org_ufid>

Purpose: Current point-in-time snapshot of who has what role on each workspace, including how they got it (direct grant or group membership).

Scope: Includes both workspaces and data collections. To filter to data collections only, JOIN to wsm_workspaces and check is_data_collection = TRUE. For a data collection-specific view with friendlier columns, use data_collection_access_grants (per-org) or data_collection_policy_grants (per-data collection) instead.

Schema

Example query

All users with WRITER+ access

SELECT
  user_email,
  workspace_user_facing_id,
  role,
  grant_type,
  group_name
FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.workspace_policy_grants_<org_ufid>`
WHERE role IN ('WRITER', 'OWNER')
ORDER BY workspace_user_facing_id, role

sam_workspace_users table

Per-org isolated tables: sam_workspace_users_<org_ufid>

Purpose: Lists all users with READER, WRITER, or OWNER access to workspaces in the org.

Scope: Includes both workspaces and data collections (treats both as the workspace resource type).

Schema

um_user_activity_in_org_log table

Per-org isolated tables: um_user_activity_in_org_log_<org_ufid>

Purpose: Timestamped log of organization, pod, and group membership changes, including when users are added or removed from groups.

Scope: Events are scoped by group, pod, or org, not by individual workspaces or data collections. To connect a group membership event to a specific data collection, JOIN to data_collection_access_grants or data_collection_policy_grants.

Schema

Key change types

Example queries

When was a user added to a group?

SELECT
  change_timestamp,
  actor_email,
  subject_id AS group_internal_name,
  JSON_VALUE(properties, '$.role') AS role_on_group,
  related_resources
FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.um_user_activity_in_org_log_<org_ufid>`
WHERE change_type = 'GRANT_ROLE_GROUP'
ORDER BY change_timestamp DESC

When did a DISCOVERER gain READER access?

To find when a user gained READER access to a data collection via group membership, JOIN this table with um_workbench_groups (to map subject_id to group_internal_name) and data_collection_policy_grants (to confirm which data collection the group grants READER on):

WITH group_grants AS (
  SELECT
    change_timestamp,
    actor_email,
    subject_id AS group_internal_name,
    related_resources
  FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.um_user_activity_in_org_log_<org_ufid>`
  WHERE change_type = 'GRANT_ROLE_GROUP'
)
SELECT
  gg.change_timestamp AS granted_at,
  gg.actor_email AS granted_by,
  g.group_name,
  gg.related_resources
FROM group_grants gg
INNER JOIN `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.um_workbench_groups_<org_ufid>` g
  ON gg.group_internal_name = g.internal_name

um_workbench_groups table

Per-org isolated tables: um_workbench_groups_<org_ufid>

Purpose: Lists all Workbench groups in the organization, mapping internal names to user-facing names.

Schema

um_users table

Per-org isolated tables: um_users_<org_ufid>

Purpose: User roster for the org (e.g., email, active state, Terms of Service status, creation date).

Schema

um_pods table

Per-org isolated tables: um_pods_<org_ufid>

Purpose: Pod metadata — name, org, billing account, environment type.

Schema

um_user_pod_roles table

Per-org isolated tables: um_user_pod_roles_<org_ufid>

Purpose: Which users have roles on which pods.

Schema

wsm_workspaces table

Per-org isolated tables: wsm_workspaces_<org_ufid>

Purpose: All workspaces in the org — ID, name, creator, cloud platform, GCP project, properties.

Scope: Includes both workspaces and data collections. Has is_data_collection column to distinguish.

Schema

wsm_resources table

Per-org isolated tables: wsm_resources_<org_ufid>

Purpose: All resources (buckets, datasets, VMs, apps) across all workspaces in the org.

Scope: Includes resources in both workspaces and data collections. Has is_data_collection column to distinguish.

Schema

data_collection_access_grants table

Per-org isolated tables: data_collection_access_grants_<org_ufid>

Purpose: Per-org flat listing of every user's effective roles on each data collection, resolving both direct user grants and group-based grants (including nested groups). Maps SAM policy groups to user-facing Workbench group names.

Scope: Data collections only (filters to is_data_collection = TRUE).

Schema

Example query

Data collection access grants with group names

SELECT
  user_email,
  data_collection_name,
  role,
  grant_type,
  user_facing_group_name
FROM `workbench-bq-log-sink.workbench_monitoring_org_logs_prod.data_collection_access_grants_<org_ufid>`
WHERE role = 'READER'
ORDER BY data_collection_name, user_email

sam_admin_groups / sam_admin_groups_all tables

Purpose: Maps organizations to their SAM admin groups (used for IAM isolation).

Schema