Ensure That Cloud Audit Logging Is Configured Properly

Risk Level: Low
Cloud Entity: GCP IAM Policy
CloudGuard Rule ID: D9.GCP.LOG.18
Covered by Spectral: Yes
Category: Security, Identity, & Compliance

GSL LOGIC

GcpIamPolicy should have auditConfigs contain [ service='allServices' and auditLogConfigs length() = 3 and auditLogConfigs contain-all [logType in('ADMIN_READ', 'DATA_READ', 'DATA_WRITE')]] and auditConfigs contain-all [auditLogConfigs contain-all [exemptedMembers isEmpty()]]

REMEDIATION

From Portal

1. Go to Audit Logs by visiting https://console.cloud.google.com/iam-admin/audit.
2. Click on Default Audit Config at the top of the page.
3. In the 'LOG TYPE' tab, select the check boxes Admin Read, Data Read, and Data Write, and click Save(All check boxes).
4. In the 'EXEMPTED USERS' tab, remove all users if any. Click Save.

From Command Line

1. To read the project's IAM policy and store it in a file run a command:

gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml

Alternatively, the policy can be set at the organization or folder level. If setting the policy at the organization level, it is not necessary to also set it for each folder or project.

gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml
gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml

2. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to:

auditConfigs:
- auditLogConfigs:
- logType: ADMIN_READ
- logType: DATA_WRITE
- logType: DATA_READ
service: allServices

Note: exemptedMembers: is not set as audit logging should be enabled for all the users.

3. To write new IAM policy run command:

gcloud organizations set-iam-policy ORGANIZATION_ID /tmp/org_policy.yaml
gcloud resource-manager folders set-iam-policy FOLDER_ID /tmp/folder_policy.yaml
gcloud projects set-iam-policy PROJECT_ID /tmp/project_policy.yaml

If the preceding command reports a conflict with another change, then repeat these steps, starting with the first step.

From TF

1. Make sure you have following values in the template for the mentioned resource and there should not be any exempted_members for any audit_log_config.
   Resource: google_project_iam_audit_config

resource "google_project_iam_audit_config" "project" {
	project = "your-project-id"
	service = "allServices"
	audit_log_config {
		log_type = "ADMIN_READ"
	}
	audit_log_config {
		log_type = "DATA_WRITE"
	}
	audit_log_config {
		log_type = "DATA_READ"
	}
}

References

1. https://cloud.google.com/logging/docs/audit/
2. https://cloud.google.com/logging/docs/audit/configure-data-access
3. https://workbench.cisecurity.org/sections/507170/recommendations/827546
4. https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam

GCP IAM Policy

You can grant roles to users by creating a Cloud IAM policy, which is a collection of statements that define who has what type of access. A policy is attached to a resource and is used to enforce access control whenever that resource is accessed.

Compliance Frameworks

• CloudGuard GCP All Rules Ruleset
• GCP CIS Controls V 8
• GCP CIS Foundations v. 1.0.0
• GCP CIS Foundations v. 1.1.0
• GCP CIS Foundations v. 1.2.0
• GCP CIS Foundations v. 1.3.0
• GCP CIS Foundations v. 2.0
• GCP CloudGuard Best Practices
• GCP MITRE ATT&CK Framework v12.1
• GCP NIST 800-53 Rev 5
• GCP PCI-DSS 4.0