Google Cloud findingView consolidated app →
← Findings by source

Google Cloud AI APIs

Google Cloud · organizations/123456789012 Google · Cloud AI platform · audit serviceName documentai.googleapis.com

Policy · none set
Policy changes re-score this app on the next sync, which starts right away.
Finding · Open
Risk score
39
Medium
People
2
Principals in Cloud Audit Logs
Audit entries
30
30 invocations · 0 denied · 30 days
First seen
Aug 27, 2026
Last seen 19 h ago
gcpinvocationsservice-account-heavy
Next steps

Recommended actions

  1. 01Google Cloud AI APIs looks well governed. Keep it in the AI inventory with an owner and re-check who can invoke it quarterly.
Billing · Google Cloud

What it costs

Last 30 days
$199
Previous 30
$217
Change
-8%
2026-06-16: 92026-06-17: 92026-06-18: 82026-06-19: 92026-06-20: 22026-06-21: 22026-06-22: 92026-06-23: 92026-06-24: 92026-06-25: 92026-06-26: 102026-06-27: 22026-06-28: 22026-06-29: 92026-06-30: 92026-07-01: 82026-07-02: 92026-07-03: 92026-07-04: 22026-07-05: 22026-07-06: 92026-07-07: 92026-07-08: 92026-07-09: 92026-07-10: 92026-07-11: 22026-07-12: 22026-07-13: 102026-07-14: 92026-07-15: 92026-07-16: 92026-07-17: 92026-07-18: 22026-07-19: 22026-07-20: 92026-07-21: 92026-07-22: 92026-07-23: 102026-07-24: 82026-07-25: 22026-07-26: 22026-07-27: 92026-07-28: 102026-07-29: 102026-07-30: 102026-07-31: 102026-08-01: 22026-08-02: 22026-08-03: 82026-08-04: 92026-08-05: 102026-08-06: 102026-08-07: 82026-08-08: 22026-08-09: 22026-08-10: 102026-08-11: 92026-08-12: 82026-08-13: 92026-08-14: 102026-08-15: 22026-08-16: 22026-08-17: 92026-08-18: 102026-08-19: 92026-08-20: 82026-08-21: 102026-08-22: 22026-08-23: 22026-08-24: 82026-08-25: 82026-08-26: 102026-08-27: 102026-08-28: 102026-08-29: 22026-08-30: 22026-08-31: 92026-09-01: 82026-09-02: 92026-09-03: 92026-09-04: 92026-09-05: 22026-09-06: 22026-09-07: 92026-09-08: 102026-09-09: 92026-09-10: 92026-09-11: 92026-09-12: 22026-09-13: 2
06-1609-13
Google Cloud (demo) · organizations/123456789012

In Google Cloud

2026-08-16: 02026-08-17: 02026-08-18: 02026-08-19: 02026-08-20: 02026-08-21: 02026-08-22: 02026-08-23: 02026-08-24: 02026-08-25: 02026-08-26: 02026-08-27: 12026-08-28: 12026-08-29: 12026-08-30: 12026-08-31: 12026-09-01: 12026-09-02: 22026-09-03: 22026-09-04: 22026-09-05: 22026-09-06: 22026-09-07: 22026-09-08: 22026-09-09: 22026-09-10: 22026-09-11: 22026-09-12: 22026-09-13: 22026-09-14: 0
08-1609-14
data access logs on30 invocations2 service accounts
Principals
PrincipalTypeEntriesDenied
[email protected]service account180
[email protected]service account120
Top methods
DocumentProcessorService.ProcessDocument18
TranslationService.TranslateText12
Projects
contoso-finance18 entries
contoso-app-dev12 entries
Resources
TypeNameProject
Processorinvoice-parsercontoso-finance
Who

People

Identifiers come from device telemetry and proxy logs, so they may be account names rather than full directory entries.

PersonDepartmentSourceSign-ins · 30 dGranted
chat-backend (service account)
[email protected]
n/aGoogle Cloud principal0No direct grant
invoice-ocr (service account)
[email protected]
n/aGoogle Cloud principal0No direct grant
Why

Evidence

  1. audit_activity · Sep 13, 2026
    Google Cloud (demo): Google Cloud AI APIs, 30 audit entries by 2 principals, 30 invocations, 1 resource, API enabled in 2 projects in 30 days across 2 projects
    Detail
    {
  "scopes": [
    "organizations/123456789012"
  ],
  "services": [
    "documentai.googleapis.com",
    "translate.googleapis.com"
  ],
  "topMethods": [
    {
      "name": "DocumentProcessorService.ProcessDocument",
      "count": 18
    },
    {
      "name": "TranslationService.TranslateText",
      "count": 12
    }
  ],
  "dataAccessLogging": true
}
  2. processor
    Processor 'invoice-parser' in contoso-finance (us)
    Detail
    {
  "name": "//documentai.googleapis.com/projects/contoso-finance/locations/us/processors/inv1",
  "type": "INVOICE_PROCESSOR"
}
  3. api_enabled
    documentai.googleapis.com enabled in contoso-finance
    Detail
    {
  "project": "contoso-finance"
}
  4. api_enabled
    translate.googleapis.com enabled in contoso-app-dev
    Detail
    {
  "project": "contoso-app-dev"
}