📝 Google GCE Network DNS Policy Logging is not enabled 🟢

• Contextual name: 📝 GCE Network DNS Policy Logging is not enabled 🟢
• ID: /ce/ca/google/vpc/network-dns-policy-logging
• Located in: 📁 Google VPC

Flags

• 🟢 Policy with categories
• 🟢 Policy with type
• 🟢 Production policy

Our Metadata

• Policy Type: COMPLIANCE_POLICY
• Policy Category:
  • SECURITY

Similar Policies

• Cloud Conformity
  • Enable Cloud DNS Logging for VPC Networks

Logic

• 🧠 prod.logic.yaml 🟢
  • 📕 Google GCE Network
  • 🔌 Google GCE Network - object.extracts.yaml
  • 🔌 Google Cloud DNS Policy - object.extracts.yaml
  • 🧪 test-data.json

Description

Open File

Description

Cloud DNS logging records the queries from the name servers within your VPC to Stackdriver. Logged queries can come from Compute Engine VMs, GKE containers, or other GCP resources provisioned within the VPC.

Rationale

Security monitoring and forensics cannot depend solely on IP addresses from VPC flow logs, especially when considering the dynamic IP usage of cloud resources, HTTP virtual host routing, and other technology that can obscure the DNS name used by a client from the IP address. Monitoring of Cloud DNS logs provides visibility to DNS names requested by the clients within the VPC. These logs can be monitored for anomalous domain names, evaluated against threat intelligence.

Note: For full capture of DNS, firewall must block egress UDP/53 (DNS) and TCP/443 (DNS over HTTPS) to prevent client from using external DNS name server for resolution.

Impact

Enabling of Cloud DNS logging might result in your project being charged for the additional logs usage.

Audit

From Google Cloud CLI

1. List all VPCs networks in a project:

... see more

Remediation

Open File

Remediation

From Google Cloud CLI

Add New DNS Policy With Logging Enabled

For each VPC network that needs a DNS policy with logging enabled:

gcloud dns policies create enable-dns-logging --enable-logging --description="Enable DNS Logging" --networks=VPC_NETWORK_NAME

The VPC_NETWORK_NAME can be one or more networks in comma-separated list

Enable Logging for Existing DNS Policy

For each VPC network that has an existing DNS policy that needs logging enabled:

gcloud dns policies update POLICY_NAME --enable-logging --networks=VPC_NETWORK_NAME

The VPC_NETWORK_NAME can be one or more networks in comma-separated list

policy.yaml

Open File

Linked Framework Sections

Section	Sub Sections	Internal Rules	Policies	Flags
💼 CIS GCP v3.0.0 → 💼 2.12 Ensure That Cloud DNS Logging Is Enabled for All VPC Networks - Level 1 (Automated)			1
💼 Cloudaware Framework → 💼 Logging and Monitoring Configuration			49