Skip to main content

🛡️ Google GKE Cluster Logging is not enabled🟢

Stats​

not available

Logic​

Similar Policies​

  • Internal: dec-x-40a68b82

Similar Internal Rules​

RulePoliciesFlags
✉️ dec-x-40a68b821

Description​

Open File

Description​

This policy identifies that Cloud Logging is enabled for all Google GKE Clusters.

Rationale​

Enabling logging for GKE clusters provides detailed insights into the behavior of the control plane, nodes, and running applications. These logs are essential for troubleshooting issues, monitoring performance, and detecting security incidents.

By default, GKE collects Audit logs, System logs, and Application logs.

Impact​

GKE logs are exported to Cloud Logging. Enabling logging may incur additional costs associated with Cloud Logging usage.

Audit​

This policy marks a Google GKE Cluster as INCOMPLIANT if Logging Service is not set to logging.googleapis.com/kubernetes.

Default Value​

Logging is enabled by default starting in GKE version 1.14.

Legacy Logging and Monitoring support is enabled by default for earlier versions.

References​

  1. https://cloud.google.com/stackdriver/docs/solutions/gke/observing
  2. https://cloud.google.com/stackdriver/docs/solutions/gke/managing-logs
  3. https://cloud.google.com/stackdriver/docs/solutions/gke/installing

... see more

Remediation​

Open File

Remediation​

To ensure comprehensive logging for troubleshooting, auditing, and security purposes, Cloud Logging should be enabled for GKE clusters.

Enable Cloud Logging on an Existing Cluster​

From Google Cloud CLI​
```sh
gcloud container clusters update {{cluster-name}} \
    --location={{location}} \
    --logging=SYSTEM,WORKLOAD,API_SERVER
```

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlagsCompliance
💼 APRA CPG 234 → 💼 16f information security reporting and analytics;1012no data
💼 APRA CPG 234 → 💼 36j monitoring controls — for timely detection of compromises to information security;1012no data
💼 APRA CPG 234 → 💼 67a network and user profiling that establishes a baseline of normal activity which, when combined with logging and alerting mechanisms, can enable detection of anomalous activity;2124no data
💼 CIS GKE v1.8.0 → 💼 5.7.1 Ensure Logging and Cloud Monitoring is Enabled (Automated)2no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration79no data
💼 FedRAMP High Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)834no data
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62344no data
💼 FedRAMP High Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)31013no data
💼 FedRAMP High Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)1920no data
💼 FedRAMP High Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)276no data
💼 FedRAMP High Security Controls → 💼 CM-3 Configuration Change Control (M)(H)443no data
💼 FedRAMP High Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)99no data
💼 FedRAMP High Security Controls → 💼 SI-4(20) Privileged Users (H)5159no data
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)26no data
💼 FedRAMP Low Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)12no data
💼 FedRAMP Low Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)20no data
💼 FedRAMP Low Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 AC-6(9) Log Use of Privileged Functions (M)(H)34no data
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)244no data
💼 FedRAMP Moderate Security Controls → 💼 AU-9 Protection of Audit Information (L)(M)(H)112no data
💼 FedRAMP Moderate Security Controls → 💼 AU-11 Audit Record Retention (L)(M)(H)20no data
💼 FedRAMP Moderate Security Controls → 💼 AU-12 Audit Record Generation (L)(M)(H)76no data
💼 FedRAMP Moderate Security Controls → 💼 CM-3 Configuration Change Control (M)(H)226no data
💼 FedRAMP Moderate Security Controls → 💼 CM-5(1) Automated Access Enforcement and Audit Records (M)(H)9no data
💼 HIPAA Security Rules → 💼 164.312(b) Audit Controls (R)33no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging1820no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.3 Administrator and operator logs99no data
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods2126no data
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors2140no data
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events2165no data
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2328no data
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed2126no data
💼 NIST CSF v1.1 → 💼 DE.DP-4: Event detection information is communicated3235no data
💼 NIST CSF v1.1 → 💼 ID.SC-4: Suppliers and third-party partners are routinely assessed using audits, test results, or other forms of evaluations to confirm they are meeting their contractual obligations1821no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1935no data
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated2126no data
💼 NIST CSF v1.1 → 💼 RS.CO-2: Incidents are reported consistent with established criteria2224no data
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities53no data
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources68no data
💼 NIST CSF v2.0 → 💼 DE.AE-06: Information on adverse events is provided to authorized staff and tools35no data
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis40no data
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events187no data
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events107no data
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events53no data
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events185no data
💼 NIST CSF v2.0 → 💼 GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship28no data
💼 NIST CSF v2.0 → 💼 ID.RA-07: Changes and exceptions are managed, assessed for risk impact, recorded, and tracked52no data
💼 NIST CSF v2.0 → 💼 ID.RA-10: Critical suppliers are assessed prior to acquisition28no data
💼 NIST CSF v2.0 → 💼 RC.CO-04: Public updates on incident recovery are shared using approved methods and messaging24no data
💼 NIST CSF v2.0 → 💼 RS.CO-02: Internal and external stakeholders are notified of incidents33no data
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated27no data
💼 NIST SP 800-53 Revision 5 → 💼 AC-6(9) Least Privilege _ Log Use of Privileged Functions1927no data
💼 NIST SP 800-53 Revision 5 → 💼 AU-12 Audit Record Generation45076no data
💼 NIST SP 800-53 Revision 5 → 💼 CM-3 Configuration Change Control81943no data
💼 PCI DSS v3.2.1 → 💼 10.1 Implement audit trails to link all access to system components to each individual user.58no data
💼 PCI DSS v3.2.1 → 💼 10.2.1 All individual user accesses to cardholder data.515no data
💼 PCI DSS v3.2.1 → 💼 10.2.2 All actions taken by any individual with root or administrative privileges.16no data
💼 PCI DSS v3.2.1 → 💼 10.2.4 Invalid logical access attempts.515no data
💼 PCI DSS v3.2.1 → 💼 10.2.7 Creation and deletion of system level objects.12no data
💼 PCI DSS v4.0.1 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.15no data
💼 PCI DSS v4.0.1 → 💼 10.2.1.2 Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.16no data
💼 PCI DSS v4.0.1 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.15no data
💼 PCI DSS v4.0 → 💼 10.2.1.1 Audit logs capture all individual user access to cardholder data.115no data
💼 PCI DSS v4.0 → 💼 10.2.1.2 Audit logs capture all actions taken by any individual with administrative access, including any interactive use of application or system accounts.16no data
💼 PCI DSS v4.0 → 💼 10.2.1.4 Audit logs capture all invalid logical access attempts.115no data
💼 SOC 2 → 💼 CC5.2-3 Establishes Relevant Security Management Process Controls Activities1737no data
💼 SOC 2 → 💼 CC7.1-2 Monitors Infrastructure and Software912no data