🛡️ Google Workspace and Cloud Identity Data Sharing with Google Cloud is not enabled🟢⚪

• Contextual name: 🛡️ Workspace and Cloud Identity Data Sharing with Google Cloud is not enabled🟢⚪
• ID: /ce/ca/google/logging/workspace-cloud-identity-data-sharing
• Tags:
  • ⚪ Impossible policy
  • 🟢 Policy with categories
  • 🟢 Policy with type
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Description

Open File

Description

Google Workspace and Cloud Identity can share administrative audit log data with Google Cloud. Enable this setting so user, password, and security configuration changes from the identity provider are available in Cloud Logging.

Rationale

Centralized identity audit logs help security teams correlate Workspace or Cloud Identity administrative events with Google Cloud resource activity. Without this setting, important identity events remain only in the Admin Console, which limits monitoring, alerting, retention, and incident investigation.

Impact

Enabling the setting sends additional audit log data to Google Cloud. Organizations should confirm that log retention, access controls, and monitoring rules are configured for the resulting Cloud Logging data.

Audit

From Google Admin Console

1. Sign in to the Google Admin Console as a Super Admin.
2. Go to Account > Account settings.
3. Open Legal and compliance.
4. Locate Sharing options > Google Cloud Platform Sharing Options.
5. Verify that the setting is Enabled.

... see more

Remediation

Open File

Remediation

From Google Admin Console

1. Sign in to the Google Admin Console as a Super Admin.
2. Go to Account > Account settings.
3. Open Legal and compliance.
4. Locate Sharing options > Google Cloud Platform Sharing Options.
5. Set the option to Enabled and click Save.
6. In Google Cloud, use Logs Explorer to confirm that Admin audit log events are arriving in Cloud Logging.

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 CIS GCP v5.0.0 → 💼 2.2 Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging - Level 1 (Manual)			1		no data
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			79		no data