🛡️ Google Storage Bucket with Log Sink does not have Versioning🟢

• Contextual name: 🛡️ Bucket with Log Sink does not have Versioning🟢
• ID: /ce/ca/google/storage/bucket-versioning
• Tags:
  • 🟢 Policy with categories
  • 🟢 Policy with type
  • 🟢 Production policy
• Policy Type: COMPLIANCE_POLICY
• Policy Categories: SECURITY

Logic

• 🧠 prod.logic.yaml🟢
  • 📗 Google Storage Bucket
  • 🔌 Google Storage Bucket - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

This policy identifies Google Storage Bucket used as destinations for Cloud Logging sinks that do not have Object Versioning enabled.

Rationale

Log data is essential for security auditing, incident response, and operational troubleshooting. Storing logs in a Cloud Storage bucket without Object Versioning introduces the risk of data loss—if a log object is overwritten or deleted, whether accidentally or maliciously, it cannot be recovered.

Enabling Object Versioning ensures that all previous versions of log objects are retained. This provides a reliable safeguard, allowing recovery of prior log versions when necessary and maintaining the integrity and continuity of your audit trail.

Impact

Enabling Object Versioning may increase storage costs due to the retention of multiple object versions.

Audit

This policy flags a Google Storage Bucket as INCOMPLIANT if it has Versioning Enabled checkbox set to false and the Bucket has a related Google Logging Log Sink as its log destination.

Remediation

Open File

Remediation

Enable Object Versioning

From gcloud CLI

To enable versioning finding, use the --versioning flag:

```sh
gcloud storage buckets update gs://{{bucket-name}} --versioning
```

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags	Compliance
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			65		no data
💼 ISO/IEC 27001:2013 → 💼 A.12.4.2 Protection of log information		1	3		no data
💼 ISO/IEC 27001:2013 → 💼 A.18.1.3 Protection of records		1	4		no data
💼 NIST CSF v1.1 → 💼 ID.GV-3: Legal and regulatory requirements regarding cybersecurity, including privacy and civil liberties obligations, are understood and managed		1	4		no data
💼 NIST CSF v1.1 → 💼 PR.IP-4: Backups of information are conducted, maintained, and tested		4	8		no data
💼 NIST CSF v1.1 → 💼 PR.PT-1: Audit/log records are determined, documented, implemented, and reviewed in accordance with policy		16	33		no data
💼 NIST CSF v2.0 → 💼 GV.OC-03: Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed			7		no data
💼 NIST CSF v2.0 → 💼 PR.DS-11: Backups of data are created, protected, maintained, and tested			12		no data
💼 NIST SP 800-53 Revision 4 → 💼 AU-11 AUDIT RECORD RETENTION	1		2		no data
💼 PCI DSS v3.2.1 → 💼 10.5 Secure audit trails so they cannot be altered.	5	1	6		no data