IssueTracker

Problem you have encountered: I've noticed logs generated by VPC Service Controls showing attempts to access private objects in Google Cloud Storage using a legitimate user account from an unrecognized IP address. These access attempts were blocked as they did not match the access levels set in the Access Context Manager. The log file is "log-1.json", with sensitive information replaced by "XXXXXXXXXX".

What you expected to happen: I expected that no unauthorized access attempts would be logged from an unrecognized IP, especially when there are no corresponding login attempts or unrecognized activity on the legitimate user account.

Steps to reproduce: The issue was not anticipated, so I am unsure about the steps to reproduce it.

Other information (workarounds you have tried, documentation consulted, etc):

• I investigated whether there had been any unauthorized logins to the legitimate user account. The user's login events showed no attempts from the unrecognized IP address.
• Performing a reverse lookup of the unrecognized IP address with the 'nslookup' command pointed to "cache.google.com".
• Around the time of the incident, there were legitimate activities from recognized IP addresses and user accounts. Logs in Google Cloud Storage show similar operations occurring approximately 3 seconds prior to the incident. There seems to be some correlation between these logs and the ones blocked by VPC Service Controls. The relevant log file is "log-2.json", with sensitive information replaced by "XXXXXXXXXX".
• I referred to a forum discussion about "cache.google.com" at WebmasterWorld: What is "cache.google.com"? - Crawler, Spider, and User Agent ID forum at WebmasterWorld - WebmasterWorld

Questions to be answered:

1. Can logs indicating access to Google Cloud Storage with a legitimate user account from an unrecognized IP address appear under normal circumstances?
2. Is "cache.google.com" currently operational as a Google caching service server? If not, what could be the possible reasons for these access attempts?