Fixes for Vault OIDC guide.

test_wif.sh

@@ -28,6 +28,8 @@ cmp README.md README.downloaded.md
 gcloud config configurations activate default
 
 # List the audit log of the operations made by the service account
+# The same query for the Logs Explorer in the console, replace SA_EMAIL:
+# protoPayload.authenticationInfo.principalEmail="SA_EMAIL"
 gcloud logging read \
     "protoPayload.authenticationInfo.principalEmail=\"${SA_EMAIL}\"" \
     --project="${PROJECT_ID}" \
@@ -35,5 +37,17 @@ gcloud logging read \
     --order=asc \
     --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
 
+# List the audit log of all data operations on the bucket, regardless of the principal
+# The same query for the Logs Explorer in the console, replace PROJECT_ID and BUCKET:
+# logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access"
+# resource.type="gcs_bucket"
+# resource.labels.bucket_name="BUCKET"
+gcloud logging read \
+    "logName=\"projects/${PROJECT_ID}/logs/cloudaudit.googleapis.com%2Fdata_access\" AND resource.type=\"gcs_bucket\" AND resource.labels.bucket_name=\"${BUCKET}\"" \
+    --project="${PROJECT_ID}" \
+    --freshness=1h \
+    --order=asc \
+    --format="table(timestamp, protoPayload.methodName, protoPayload.resourceName:label=RESOURCE, protoPayload.authenticationInfo.principalEmail:label=EMAIL, protoPayload.authenticationInfo.principalSubject:label=SUBJECT, protoPayload.authenticationInfo.serviceAccountDelegationInfo[0].principalSubject:label=DELEGATED_BY)"
+
 # optionally switch back to the service account for further testing
 # gcloud config configurations activate wif-test