Vertex AI経由でのClaude Code利用の監査ログ周りについて調査する

# 監査ログ閲覧者にPrivate Logs Viewerロールを付与
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="user:LOG_VIEWER_EMAIL" \
  --role="roles/logging.privateLogViewer"

resource.type="audited_resource"
protoPayload.serviceName="aiplatform.googleapis.com"
protoPayload.authorizationInfo.permissionType="DATA_READ"

{
  insertId: "****"
  logName: "projects/****/logs/cloudaudit.googleapis.com%2Fdata_access"
  operation: {
    first: true
    id: "****"
    producer: "aiplatform.googleapis.com"
  }
  protoPayload: {
    @type: "type.googleapis.com/google.cloud.audit.AuditLog"
    authenticationInfo: {
      oauthInfo: {
        oauthClientId: "****.apps.googleusercontent.com" (Google Auth Library)
      }
      principalEmail: "****@****.jp"
      principalSubject: "user:****@****.jp"
    }
    authorizationInfo: [
      0: {
        granted: true
        permission: "aiplatform.endpoints.predict"
        permissionType: "DATA_READ"
        resource: "projects/****/locations/global/publishers/anthropic/models/claude-sonnet-4-6"
        resourceAttributes: {
        }
      }
    ]
    methodName: "google.cloud.aiplatform.v1.PredictionService.StreamRawPredict"
    request: {
      @type: "type.googleapis.com/google.cloud.aiplatform.v1.StreamRawPredictRequest"
      endpoint: "projects/****/locations/global/publishers/anthropic/models/claude-sonnet-4-6"
    }
    requestMetadata: {
      callerIp: "***.***.***.***"
      callerSuppliedUserAgent: "claude-cli/2.1.104 (external, cli),gzip(gfe)"
      destinationAttributes: {
      }
      requestAttributes: {
        auth: {
        }
        time: "2026-04-12T22:56:15.751663977Z"
      }
    }
    resourceName: "projects/****/locations/global/publishers/anthropic/models/claude-sonnet-4-6"
    response: {
      @type: "type.googleapis.com/google.api.HttpBody"
    }
    serviceName: "aiplatform.googleapis.com"
    status: {
    }
  }
  receiveTimestamp: "2026-04-12T22:56:18.792616870Z"
  resource: {
    labels: {
      method: "google.cloud.aiplatform.v1.PredictionService.StreamRawPredict"
      project_id: "****"
      service: "aiplatform.googleapis.com"
    }
    type: "audited_resource"
  }
  severity: "INFO"
  timestamp: "2026-04-12T22:56:15.741821158Z"
}

bq mk \
  --location=US \
  --dataset \
  "${GOOGLE_CLOUD_PROJECT}:vertex_ai_logs"

curl -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{
    "publisherModelConfig": {
      "loggingConfig": {
        "enabled": true,
        "samplingRate": 1.0,
        "bigqueryDestination": {
          "outputUri": "bq://${GOOGLE_CLOUD_PROJECT}.vertex_ai_logs"
        },
        "enableOtelLogging": true
      }
    }
  }' \
  "https://us-east5-aiplatform.googleapis.com/v1beta1/projects/${GOOGLE_CLOUD_PROJECT}/locations/us-east5/publishers/anthropic/models/claude-sonnet-4-6:setPublisherModelConfig"

curl -X POST \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  -H "Content-Type: application/json" \
  -d '{
    "publisherModelConfig": {
      "loggingConfig": {
        "enabled": true,
        "samplingRate": 1.0,
        "bigqueryDestination": {
          "outputUri": "bq://${GOOGLE_CLOUD_PROJECT}.vertex_ai_logs"
        },
        "enableOtelLogging": true
      }
    }
  }' \
  "https://us-east5-aiplatform.googleapis.com/v1beta1/projects/${GOOGLE_CLOUD_PROJECT}/locations/us-east5/publishers/anthropic/models/claude-haiku-4-5:setPublisherModelConfig"

curl -X GET \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://us-east5-aiplatform.googleapis.com/v1beta1/projects/${GOOGLE_CLOUD_PROJECT}/locations/us-east5/publishers/anthropic/models/claude-sonnet-4-6:fetchPublisherModelConfig"

curl -X GET \
  -H "Authorization: Bearer $(gcloud auth print-access-token)" \
  "https://us-east5-aiplatform.googleapis.com/v1beta1/projects/${GOOGLE_CLOUD_PROJECT}/locations/us-east5/publishers/anthropic/models/claude-haiku-4-5:fetchPublisherModelConfig"

{
  "loggingConfig": {
    "enabled": true,
    "samplingRate": 1,
    "bigqueryDestination": {
      "outputUri": "bq://${GOOGLE_CLOUD_PROJECT}.vertex_ai_logs.request_response_logging"
    },
    "enableOtelLogging": true
  }
}

SELECT
  logging_time,
  model,
  api_method,
  ARRAY_TO_STRING(request_payload, "") AS request_payload,
  ARRAY_TO_STRING(response_payload, "") AS response_payload
FROM `your-project-id.vertex_ai_logs.request_response_logging`
ORDER BY logging_time DESC
LIMIT 10;

WITH messages AS (
  SELECT
    pos,
    JSON_VALUE(m, "$.role") AS role,
    COALESCE(
      JSON_VALUE(m, "$.content"),
      (SELECT STRING_AGG(JSON_VALUE(cb, "$.text"), "\n")
       FROM UNNEST(JSON_QUERY_ARRAY(m, "$.content")) cb
       WHERE JSON_VALUE(cb, "$.type") = "text"
         AND JSON_VALUE(cb, "$.text") NOT LIKE "<%")
    ) AS content
  FROM UNNEST(
    JSON_QUERY_ARRAY(
      SAFE.PARSE_JSON(
        ARRAY_TO_STRING(
          (SELECT request_payload
           FROM `your-project-id.vertex_ai_logs.request_response_logging`
           ORDER BY logging_time DESC LIMIT 1),
          ""
        )
      ),
      "$.messages"
    )
  ) AS m WITH OFFSET pos
)
SELECT pos, role, LEFT(content, 300) AS content
FROM messages
WHERE content IS NOT NULL AND content != ""
  AND content NOT LIKE "<%"
  AND content NOT LIKE "Tool loaded%"
  AND content NOT LIKE "Base directory for this skill:%"
ORDER BY pos;

WITH token_usage AS (
  SELECT
    model,
    SAFE_CAST(REGEXP_EXTRACT(ARRAY_TO_STRING(response_payload, ""), r'"message_delta".*?"input_tokens":(\d+)') AS INT64) AS input_tokens,
    SAFE_CAST(REGEXP_EXTRACT(ARRAY_TO_STRING(response_payload, ""), r'"message_delta".*?"cache_creation_input_tokens":(\d+)') AS INT64) AS cache_creation_tokens,
    SAFE_CAST(REGEXP_EXTRACT(ARRAY_TO_STRING(response_payload, ""), r'"message_delta".*?"cache_read_input_tokens":(\d+)') AS INT64) AS cache_read_tokens,
    SAFE_CAST(REGEXP_EXTRACT(ARRAY_TO_STRING(response_payload, ""), r'"message_delta".*?"output_tokens":(\d+)') AS INT64) AS output_tokens
  FROM `your-project-id.vertex_ai_logs.request_response_logging`
)
SELECT
  REGEXP_EXTRACT(model, r'models/(.+)$') AS model,
  COUNT(*) AS request_count,
  SUM(input_tokens) AS total_input_tokens,
  SUM(cache_creation_tokens) AS total_cache_creation_tokens,
  SUM(cache_read_tokens) AS total_cache_read_tokens,
  SUM(output_tokens) AS total_output_tokens,
  ROUND(
    SAFE_DIVIDE(
      SUM(cache_read_tokens),
      SUM(cache_read_tokens) + SUM(cache_creation_tokens)
    ) * 100, 1
  ) AS cache_hit_rate_pct
FROM token_usage
GROUP BY model;

WITH conversation_depth AS (
  SELECT
    logging_time,
    REGEXP_EXTRACT(model, r'models/(.+)$') AS model,
    ARRAY_LENGTH(
      JSON_QUERY_ARRAY(
        SAFE.PARSE_JSON(ARRAY_TO_STRING(request_payload, "")),
        '$.messages'
      )
    ) AS message_count
  FROM `your-project-id.vertex_ai_logs.request_response_logging`
)
SELECT
  model,
  COUNT(*) AS request_count,
  MIN(message_count) AS min_messages,
  MAX(message_count) AS max_messages,
  ROUND(AVG(message_count), 1) AS avg_messages
FROM conversation_depth
GROUP BY model;

{
  "device_id": "****...（SHA-256ハッシュ）",
  "account_uuid": "",
  "session_id": "4341ec45-b341-4848-ace7-9e5911fc7ace"
}