Control: 2.1 Ensure that Cloud Audit Logging is configured properly across all services and all users from a project
It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data. Admin Activity logs are always enabled. They cannot be disabled. Data Access audit logs are disabled by default because they can be quite large.
Cloud Audit Logging maintains two audit logs for each project, folder, and organization: Admin Activity and Data Access.
- Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. Admin Activity audit logs are enabled for all services and cannot be configured.
- Data Access audit logs record API calls that create, modify, or read user-provided data. These are disabled by default and should be enabled.
There are three kinds of Data Access audit log information:
- Admin read: Records operations that read metadata or configuration information. Admin activity audit logs record writes of metadata and configuration information that cannot be disabled.
- Data read: Records operations that read user-provided data.
- Data write: Records operations that write user-provided data.
It is recommended to have an effective default audit config configured in such a way that:
- Logtype is set to DATA_READ (to log user activity tracking) and DATA_WRITES (to log changes/tampering to user data).
- Audit config is enabled for all the services supported by the Data Access audit logs feature.
- Logs should be captured for all users, i.e., there are no exempted users in any of the audit config sections. This will ensure overriding the audit config will not contradict the requirement.
- Login to GCP console and navigate to IAM & Admin.
- Click on Default Audit Config at the top of the page.
- In the LOG TYPE tab, select the check boxes
Data Read, and
Data Write, and click Save.
- In the EXEMPTED USERS tab, remove all users if any. Click Save.
For more details, you can refer Configuring Data Access audit logs guide
From Command Line
- To read the project's IAM policy and store it in a file run a command:
gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml
Alternatively, the policy can be set at the organization or folder level. If setting the policy at the organization level, it is not necessary to also set it for each folder or project.
gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml
- Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to:
auditConfigs:- auditLogConfigs:- logType: DATA_WRITE- logType: DATA_READservice: allServices
exemptedMembers: is not set as audit logging should be enabled for all the users
- To write new IAM policy run command:
gcloud organizations set-iam-policy ORGANIZATION_ID /tmp/org_policy.yaml gcloud resource-manager folders set-iam-policy FOLDER_ID /tmp/folder_policy.yamlgcloud projects set-iam-policy PROJECT_ID /tmp/project_policy.yaml
If the preceding command reports a conflict with another change, then repeat these steps, starting with the first step.
steampipe check gcp_compliance.control.cis_v120_2_1
This control uses a named query:audit_logging_configured_for_all_service