title: Which tools can be use to do user and service account auditing when using Cloud NAT on GCP?
body: <p>We use our proxy server to access internet when we need to download packages from Internet like <code>conda</code>, <code>pip</code> and <code>debian</code> in 2 cases:<br>
  - from <code>AI Platform notebook</code><br>
  - from <code>Dataflow</code> jobs (workers)  </p>
  
  <p>Our security team can monitor and see which user or services account is accessing which URLs (I think this is needed for audit and compliance. I don't know all the details but I think the idea is to be able to look back to so event and see what happened and what was done). The issue is that the proxy server is not design for such heavy load and it is a very bad practice to use it in this case. I want to use <code>Cloud NAT</code> which is specially design for that. Technically this is working perfectly.</p>
  
  <p>Which tools from <code>GCP</code> or other provider is design to do such auditing and could be use to monitor what is done on the <code>Cloud NAT</code>? It doesn't see to be possible to get such information with Cloud NAT <a href="https://cloud.google.com/nat/docs/overview" rel="nofollow noreferrer">Cloud NAT overview</a>, <a href="https://cloud.google.com/nat/docs/monitoring" rel="nofollow noreferrer">Cloud NAT monitoring</a> and <a href="https://cloud.google.com/nat/docs/monitoring#log_fields" rel="nofollow noreferrer">Cloud NAT log_fields</a>. I am not an IT security person so maybe I am not using the right words and I hope experts will understand what I am looking for.</p>