You are investigating a security incident and need to find out who deleted a critical Compute Engine instance yesterday.

Which type of Cloud Audit Log should you review?

Cloud Audit Logs are divided into several categories. Admin Activity audit logs record API calls and administrative actions that modify the configuration or metadata of resources. Creating, updating, or deleting a Compute Engine instance falls under this category. These logs are enabled by default and cannot be disabled. Data Access logs, on the other hand, record API calls that read the configuration or metadata of resources, as well as user-driven API calls that create, modify, or read user-provided resource data.