An employee was terminated but retained Google Cloud access for two weeks. To check whether they accessed sensitive customer data after termination, where should you look and what should you search for?

To determine if a terminated employee accessed sensitive customer data, you should examine Data Access audit logs in Cloud Logging. These logs record API calls that read or modify user-provided data, which would include access to sensitive customer information. Searching for the user's email as the principal (the identity performing the action) will filter these logs to show only actions taken by that specific individual. System Event logs track Google Cloud administrative events, not user data access. Admin Activity logs record administrative actions and metadata, not data access. Service accounts are typically used by applications or services, not directly by individual users for their daily data access.