Contribution to Turbot's Steampipe (Google Workspace)

TL;DR

Steampipe lets you query cloud and SaaS as SQL. I added the googleworkspace_admin_reports_activity table to the Google Workspace plugin, wrapping the Google Admin Reports API (Activities.list). It turns a Workspace tenant's audit logs into queryable rows: admin actions, logins, OAuth token grants, Drive events and mobile-device activity. Merged into turbot/steampipe-plugin-googleworkspace (PR #88).

Why it matters

Audit logs are where detection lives. With one table, security questions become plain SQL:

-- failed logins, by source IP
select time, actor_email, ip_address, event_name
from googleworkspace_admin_reports_activity
where application_name = 'login'
  and event_name = 'login_failure';

A required application_name qualifier picks the log source: admin, drive, login, mobile or token.

Design notes

The PR began as five separate tables. On maintainer review it became one consolidated table, which keeps the plugin's surface small and consistent. Two things made it usable at scale:

• Filter push-down. The event_name qualifier is pushed to the API (exact-match, cached) instead of filtering client-side, so where event_name = ... doesn't pull the entire log.
• No lossy extraction. Per review, raw event parameters are surfaced as-is rather than flattened into guessed columns, so results stay accurate.

Thirteen files, one table, merged July 2025.