SELECT
  timestamp,
  protopayload_auditlog.authenticationInfo.principalEmail AS actor,
  protopayload_auditlog.resourceName AS targetResource,
  jsonPayload.request.keyType AS keyType
FROM
  `project-id.dataset.cloudaudit_googleapis_com_activity_*`
WHERE
  protopayload_auditlog.methodName = "google.iam.admin.v1.CreateServiceAccountKey"
  AND _PARTITIONTIME >= TIMESTAMP_SUB(CURRENT_TIMESTAMP(), INTERVAL 1 DAY)
