You suspect that an unauthorized user has been reading sensitive data from a Cloud Storage bucket. Which type of audit log must be enabled to investigate this?

Data Access audit logs record API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data (like downloading a file from Cloud Storage). Because these logs can be very large, they are disabled by default and must be explicitly enabled.