diff --git a/.gitignore b/.gitignore
index c71c48f..a0fa763 100644
--- a/.gitignore
+++ b/.gitignore
@@ -4,3 +4,5 @@ node_modules/
 cred.json
 trust_store.yaml
 package-lock.json
+*.downloaded.md
+iam_policy.yaml
diff --git a/README.md b/README.md
index 7da1e62..fe9178e 100644
--- a/README.md
+++ b/README.md
@@ -121,7 +121,7 @@ The PEM files must contain only the certificate block. A trailing newline after
 
 ## 3. Create the pool, provider and credentials
 
-The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
+The script creates the workload identity pool, the X.509 provider and a service account. It allows the client certificate subject to impersonate the service account, grants the service account read access to the project, creates a storage bucket with read and write access to its objects for the service account, and writes `cred.json`. It then logs in with `cred.json` and checks the access.
 
 ```bash
 # Create a workload identity pool and a X.509 provider
@@ -154,6 +154,17 @@ gcloud projects add-iam-policy-binding my-project \
     --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
     --role=roles/browser
 
+# Create a storage bucket
+gcloud storage buckets create gs://my-project-wif-test \
+    --project=my-project \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://my-project-wif-test \
+    --member="serviceAccount:sa-test@my-project.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
 # Create credentials configuration files
 gcloud iam workload-identity-pools create-cred-config \
     projects/123456789012/locations/global/workloadIdentityPools/my-pool/providers/my-x509 \
diff --git a/add_audit_config.mjs b/add_audit_config.mjs
new file mode 100644
index 0000000..bd77581
--- /dev/null
+++ b/add_audit_config.mjs
@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+import { readFileSync, writeFileSync } from "node:fs";
+import YAML from "yaml";
+
+const policy = YAML.parse(readFileSync("iam_policy.yaml", "utf8"));
+
+// Replace the Cloud Storage entry, if any, and keep the other audit configs.
+policy.auditConfigs = (policy.auditConfigs ?? []).filter(
+  (c) => c.service !== "storage.googleapis.com",
+);
+policy.auditConfigs.push({
+  service: "storage.googleapis.com",
+  auditLogConfigs: [{ logType: "DATA_READ" }, { logType: "DATA_WRITE" }],
+});
+
+writeFileSync("iam_policy.yaml", YAML.stringify(policy, { indentSeq: false }));
diff --git a/make_wif.sh b/make_wif.sh
index a1b6d2a..1fd3bdf 100755
--- a/make_wif.sh
+++ b/make_wif.sh
@@ -36,9 +36,31 @@ gcloud iam workload-identity-pools create-cred-config \
     --credential-cert-private-key-path=client_key.pem \
     --output-file=cred.json
 
+# Create a storage bucket
+gcloud storage buckets create gs://dom-lab-wif-test \
+    --project=dom-lab \
+    --location=europe-central2 \
+    --uniform-bucket-level-access
+
+# Allow the service account to read and write objects in the bucket
+gcloud storage buckets add-iam-policy-binding gs://dom-lab-wif-test \
+    --member="serviceAccount:sa-test@dom-lab.iam.gserviceaccount.com" \
+    --role=roles/storage.objectUser
+
+# Enable Data Access audit logs for Cloud Storage (project-wide, not per bucket)
+gcloud projects get-iam-policy dom-lab --format=yaml > iam_policy.yaml
+node add_audit_config.mjs
+gcloud projects set-iam-policy dom-lab iam_policy.yaml
+
+# Create a new gcloud configuration for the workload identity federation test
+gcloud config configurations create wif-test
+
 # Authenticate gcloud with the credentials configuration file
 gcloud auth login --cred-file=cred.json
 
+# Set the project to dom-lab
+gcloud config set project dom-lab
+
 # Test the authentication by listing the project details
 gcloud auth list
 gcloud projects describe dom-lab
@@ -46,8 +68,23 @@ gcloud projects get-iam-policy dom-lab \
     --flatten="bindings[].members" \
     --format="table(bindings.role, bindings.members)"
 
-# Then, switch back to your original account
-gcloud config set account adminslawek@gcp-lab.koszewscy.waw.pl
+# Test the bucket access by uploading and downloading a file
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp README.md gs://dom-lab-wif-test/README.md
+gcloud storage ls gs://dom-lab-wif-test
+gcloud storage cp gs://dom-lab-wif-test/README.md README.downloaded.md
+cmp README.md README.downloaded.md
 
-# and again switch back to the service account using the credentials configuration file
-gcloud config set account sa-test@dom-lab.iam.gserviceaccount.com
+# Then, switch back to your original account
+gcloud config configurations activate default
+
+# List the audit log of the operations made by the service account
+gcloud logging read \
+    'protoPayload.authenticationInfo.principalEmail="sa-test@dom-lab.iam.gserviceaccount.com"' \
+    --project=dom-lab \
+    --freshness=1h \
+    --order=asc \
+    --format="table(timestamp, protoPayload.serviceName, protoPayload.methodName)"
+
+# and again switch back to the service account
+gcloud config configurations activate wif-test