Skip to main content

📝 Google Cloud Audit Logging is not configured properly 🟢

  • Contextual name: 📝 Cloud Audit Logging is not configured properly 🟢
  • ID: /ce/ca/google/logging/audit-logging-configuration
  • Located in: 📁 Google Logging

Flags​

Our Metadata​

  • Policy Type: COMPLIANCE_POLICY
  • Policy Category:
    • SECURITY

Similar Policies​

Logic​

Description​

Open File

Description​

It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data.

Rationale​

Cloud Audit Logging maintains two audit logs for each project, folder, and organization:

Admin Activity and Data Access.

  1. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity audit logs are enabled for all services and cannot be configured.
  2. Data Access audit logs record API calls that create, modify, or read user-provided data. These are disabled by default and should be enabled.

There are three kinds of Data Access audit log information:

o Admin read: Records operations that read metadata or configuration information. Admin Activity audit logs record writes of metadata and configuration information that cannot be disabled.
o Data read: Records operations that read user-provided data.
o Data write: Records operations that write user-provided data.

It is recommended to have an effective default audit config configured in such a way that:

... see more

Remediation​

Open File

Remediation​

From Google Cloud Console​

  1. Go to Audit Logs by visiting https://console.cloud.google.com/iam-admin/audit.
  2. Follow the steps at https://cloud.google.com/logging/docs/audit/configure-data-access to enable audit logs for all Google Cloud services. Ensure that no exemptions are allowed.

From Google Cloud CLI​

  1. To read the project's IAM policy and store it in a file run a command:

     gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml

    Alternatively, the policy can be set at the organization or folder level. If setting the policy at the organization level, it is not necessary to also set it for each folder or project.

     gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml

     gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml

  2. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to:

    Note: Admin Activity Logs are enabled by default, and cannot be disabled. So they are not listed in these configuration changes.

... see more

policy.yaml​

Open File

Linked Framework Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 CIS GCP v1.2.0 → 💼 2.1 Ensure that Cloud Audit Logging is configured properly across all services and all users from a project - Level 1 (Automated _ Roadmapped)1
💼 CIS GCP v1.3.0 → 💼 2.1 Ensure That Cloud Audit Logging Is Configured Properly Across All Services and All Users From a Project - Level 1 (Automated)1
💼 CIS GCP v2.0.0 → 💼 2.1 Ensure That Cloud Audit Logging Is Configured Properly - Level 1 (Automated)1
💼 CIS GCP v3.0.0 → 💼 2.1 Ensure That Cloud Audit Logging Is Configured Properly - Level 1 (Automated)1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration51
💼 FedRAMP High Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)62129
💼 FedRAMP High Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)118
💼 FedRAMP Low Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)25
💼 FedRAMP Moderate Security Controls → 💼 AU-6 Audit Record Review, Analysis, and Reporting (L)(M)(H)229
💼 FedRAMP Moderate Security Controls → 💼 AU-7 Audit Record Reduction and Report Generation (M)(H)118
💼 ISO/IEC 27001:2013 → 💼 A.12.4.1 Event logging1619
💼 ISO/IEC 27001:2013 → 💼 A.16.1.7 Collection of evidence1
💼 ISO/IEC 27001:2022 → 💼 5.25 Assessment and decision on information security events13
💼 NIST CSF v1.1 → 💼 DE.AE-2: Detected events are analyzed to understand attack targets and methods1924
💼 NIST CSF v1.1 → 💼 DE.AE-3: Event data are collected and correlated from multiple sources and sensors1938
💼 NIST CSF v1.1 → 💼 DE.CM-1: The network is monitored to detect potential cybersecurity events1942
💼 NIST CSF v1.1 → 💼 DE.CM-3: Personnel activity is monitored to detect potential cybersecurity events2127
💼 NIST CSF v1.1 → 💼 DE.CM-7: Monitoring for unauthorized personnel, connections, devices, and software is performed1924
💼 NIST CSF v1.1 → 💼 PR.AC-1: Identities and credentials are issued, managed, verified, revoked, and audited for authorized devices, users and processes1930
💼 NIST CSF v1.1 → 💼 PR.AC-4: Access permissions and authorizations are managed, incorporating the principles of least privilege and separation of duties1551
💼 NIST CSF v1.1 → 💼 PR.AC-6: Identities are proofed and bound to credentials and asserted in interactions413
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy1733
💼 NIST CSF v1.1 → 💼 RS.AN-1: Notifications from detection systems are investigated1924
💼 NIST CSF v1.1 → 💼 RS.AN-3: Forensics are performed1
💼 NIST CSF v2.0 → 💼 DE.AE-02: Potentially adverse events are analyzed to better understand associated activities30
💼 NIST CSF v2.0 → 💼 DE.AE-03: Information is correlated from multiple sources45
💼 NIST CSF v2.0 → 💼 DE.AE-07: Cyber threat intelligence and other contextual information are integrated into the analysis38
💼 NIST CSF v2.0 → 💼 DE.CM-01: Networks and network services are monitored to find potentially adverse events111
💼 NIST CSF v2.0 → 💼 DE.CM-03: Personnel activity and technology usage are monitored to find potentially adverse events80
💼 NIST CSF v2.0 → 💼 DE.CM-06: External service provider activities and services are monitored to find potentially adverse events30
💼 NIST CSF v2.0 → 💼 DE.CM-09: Computing hardware and software, runtime environments, and their data are monitored to find potentially adverse events129
💼 NIST CSF v2.0 → 💼 PR.AA-01: Identities and credentials for authorized users, services, and hardware are managed by the organization38
💼 NIST CSF v2.0 → 💼 PR.AA-02: Identities are proofed and bound to credentials based on the context of interactions13
💼 NIST CSF v2.0 → 💼 PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties86
💼 NIST CSF v2.0 → 💼 RS.AN-03: Analysis is performed to establish what has taken place during an incident and the root cause of the incident17
💼 NIST CSF v2.0 → 💼 RS.AN-06: Actions performed during an investigation are recorded, and the records' integrity and provenance are preserved18
💼 NIST CSF v2.0 → 💼 RS.AN-07: Incident data and metadata are collected, and their integrity and provenance are preserved18
💼 NIST CSF v2.0 → 💼 RS.MA-02: Incident reports are triaged and validated25
💼 NIST SP 800-53 Revision 4 → 💼 AC-2 ACCOUNT MANAGEMENT1325
💼 NIST SP 800-53 Revision 5 → 💼 AU-6 Audit Record Review, Analysis, and Reporting10110
💼 NIST SP 800-53 Revision 5 → 💼 AU-7 Audit Record Reduction and Report Generation2118
💼 PCI DSS v3.2.1 → 💼 10.1 Implement audit trails to link all access to system components to each individual user.45
💼 PCI DSS v3.2.1 → 💼 10.2 Implement automated audit trails for all system components.7725
💼 PCI DSS v3.2.1 → 💼 10.6.1 Review security events and critical system component logs at least daily.2
💼 PCI DSS v3.2.1 → 💼 10.6.2 Review logs of all other system components periodically based on the organization's policies and risk management strategy, as determined by the organization's annual risk assessment.4
💼 PCI DSS v3.2.1 → 💼 10.6.3 Follow up exceptions and anomalies identified during the review process.2
💼 PCI DSS v4.0.1 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.724
💼 PCI DSS v4.0.1 → 💼 10.4.1 The audit logs are reviewed at least once daily.12
💼 PCI DSS v4.0.1 → 💼 10.4.1.1 Automated mechanisms are used to perform audit log reviews.2
💼 PCI DSS v4.0.1 → 💼 10.4.2 Logs of all other system components are reviewed periodically.14
💼 PCI DSS v4.0.1 → 💼 10.4.2.1 The frequency of periodic log reviews for all other system components is defined in the entity's targeted risk analysis.2
💼 PCI DSS v4.0.1 → 💼 10.4.3 Exceptions and anomalies identified during the review process are addressed.2
💼 PCI DSS v4.0 → 💼 10.2.1 Audit logs are enabled and active for all system components and cardholder data.724
💼 PCI DSS v4.0 → 💼 10.4.1 The audit logs are reviewed at least once daily.12
💼 PCI DSS v4.0 → 💼 10.4.1.1 Automated mechanisms are used to perform audit log reviews.2
💼 PCI DSS v4.0 → 💼 10.4.2 Logs of all other system components are reviewed periodically.14
💼 PCI DSS v4.0 → 💼 10.4.2.1 The frequency of periodic log reviews for all other system components is defined in the entity's targeted risk analysis.2
💼 PCI DSS v4.0 → 💼 10.4.3 Exceptions and anomalies identified during the review process are addressed.2
💼 SOC 2 → 💼 CC4.1-1 Considers a Mix of Ongoing and Separate Evaluations2
💼 SOC 2 → 💼 CC4.1-2 Considers Rate of Change2
💼 SOC 2 → 💼 CC4.1-3 Establishes Baseline Understanding2
💼 SOC 2 → 💼 CC4.1-4 Uses Knowledgeable Personnel2
💼 SOC 2 → 💼 CC4.1-5 Integrates With Business Processes2
💼 SOC 2 → 💼 CC4.1-6 Adjusts Scope and Frequency2
💼 SOC 2 → 💼 CC4.1-7 Objectively Evaluates2
💼 SOC 2 → 💼 CC4.1-8 Considers Different Types of Ongoing and Separate Evaluations2
💼 SOC 2 → 💼 CC7.3-1 Responds to Security Incidents2
💼 SOC 2 → 💼 CC7.3-2 Communicates and Reviews Detected Security Events2
💼 SOC 2 → 💼 CC7.3-3 Develops and Implements Procedures to Analyze Security Incidents2
💼 SOC 2 → 💼 CC7.3-4 Assesses the Impact on Confidential Information2
💼 SOC 2 → 💼 CC7.3-5 Determines Confidential Information Used or Disclosed2