Cloud Audit Logs
The four types of GCP audit log, and a common pitfall — Data Access audit logging is configured via IAM auditConfigs, not Organization Policy.
Aggregated log sink
Use an Organization-level aggregated sink to route logs from every project into a dedicated logging project, fanning out to Log Analytics, Cloud Storage and a SIEM.
Retention policy and cost
Default log bucket retention periods, the irreversible risk of log bucket locking, and cost-control advice for Data Access logs.