Query: Ensure log metric filter and alerts exist for project ownership assignments/changes

Description

In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all roles/Owner assignments should be monitored. Members (users/Service-Accounts) with a role assignment to primitive role roles/Owner are project owners.

Query

Tables used in this query:

• gcp_logging_metric
• gcp_monitoring_alert_policy
• gcp_project

Controls using this query:

• 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
• 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
• 2.4 Ensure log metric filter and alerts exist for project ownership assignments/changes
• 2.4 Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes
• Ensure log metric filter and alerts exist for project ownership assignments/changes

SQL