Skip to main content

💼 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes

  • Contextual name: 💼 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
  • ID: /frameworks/cis-gcp-v1.1.0/02/04
  • Located in: 💼 2 Logging and Monitoring

Description​

In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all 'roles/Owner' assignments should be monitored.

Members (users/Service-Accounts) with a role assignment to primitive role 'roles/Owner' are project owners.

The project owner has all the privileges on the project the role belongs to. These are summarized below:

'''

  • All viewer permissions on all GCP Services within the project

  • Permissions for actions that modify the state of all GCP services within the project

  • Manage roles and permissions for a project and all resources within the project

  • Set up billing for a project '''

Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.

Similar​

  • Internal
    • ID: dec-c-692f3780

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags