GCP audit events - "principalEmail" is not in the format of an email.

Google Cloud Cloud Foundations & Onboarding
,
1

I’m seeing audit events where the content of “principalEmail” is not in the format of an email.

I would like to understand what is the meaning of the content placed there.
Does this indicates an action performed by a service account? if so why isn’t the service account email shown?

Examples:

“authenticationInfo”:{“principalEmail”:“system:serviceaccount:kube-system:ang-daemon”}
“authenticationInfo”:{“principalEmail”:“system:serviceaccount:apigee-system:default”}
“authenticationInfo”:{“principalEmail”:“system:serviceaccount:config-management-system:root-reconciler”}

2

I would like to have more context to correctly answer your question, in the event viewer why should “pricipalEmail” be in email format? Or, is that a different problem? Where are you watching the events? Or, are you reviewing the Audit logs?