> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Audit Configuration Logging ### More Info: Ensures that logging and log alerts exist for audit configuration changes. Project Ownership is the highest level of privilege on a project, any changes in audit configuration should be heavily monitored to prevent unauthorized changes. ### Risk Level High ### Address Security ### Compliance Standards PCI, HIPAA ### Triage and Remediation ### Remediation To remediate **Audit Configuration Logging** for **GCP IAM** using the **GCP Console**, you need to ensure that Cloud Audit Logs (especially Admin Activity and appropriate Data Access logs) are enabled for IAM and that logs are being exported/retained as needed. ### 1. Verify IAM Audit Logs Are Enabled 1. Go to **Google Cloud Console**:\ [https://console.cloud.google.com](https://console.cloud.google.com) 2. Select the **project** (or folder/organization) you want to remediate from the top project selector. 3. In the left menu, go to:\ **IAM & Admin → Audit Logs** 4. At the top, select the **scope**: * If you have access, switch to **Organization** or **Folder** level using the scope selector. * Otherwise, do it at the **project** level. 5. In the **“Audit logs”** page: * In the **Service** list, find and select: * **IAM Service Account Credentials API** * **Cloud Identity and Access Management (iam.googleapis.com)**\ (names may vary slightly, but look for IAM-related services) * Or simply click **All services** if your policy requires global coverage. 6. For each relevant service, ensure: * **Admin Read**: Enabled (checkbox checked) * **Admin Write**: Enabled * **Data Read**: Enable if your policy requires data access logging * **Data Write**: Enable if your policy requires data access logging 7. Click **Save** at the bottom. > Note: > > * **Admin Activity** logs are on by default and can’t be disabled, but explicitly enabling the checkboxes ensures consistent configuration and visibility in the UI. > * **Data Access** logs (Data Read/Write) may incur additional cost; enable them to match your compliance requirements. *** ### 2. Confirm Logs Are Being Written 1. Go to **Logging → Logs Explorer** in the left menu. 2. Ensure the correct **project** is selected at the top. 3. In the query builder, run a basic query to view IAM audit logs, for example: * Click **“Query builder → Resource”**, select a resource type like: * `IAM Service Account`, or * `Project` * Then in the **Log name** filter, choose: * `cloudaudit.googleapis.com/activity` * and/or `cloudaudit.googleapis.com/data` 4. Click **Run query** and verify that IAM-related admin and data access events are appearing. *** ### 3. (Optional) Configure Log Retention or Export If your audit requirement includes long-term retention or external SIEM: 1. Go to **Logging → Log Router**. 2. Click **Create Sink**: * Give it a name (e.g., `iam-audit-logs-sink`). * In the **Sink destination**, choose: * **Cloud Storage** (for archive), or * **BigQuery** (for analytics), or * **Pub/Sub** (for SIEM forwarding). 3. In the **Build inclusion filter**, restrict to IAM audit logs, for example: ```text theme={null} logName:"cloudaudit.googleapis.com" AND protoPayload.serviceName="iam.googleapis.com" ``` 4. Complete sink creation, granting the sink’s service account the required write permissions on the destination. *** ### 4. (Optional) Enforce via Organization Policy To prevent disabling audit logs: 1. Go to **IAM & Admin → Organization policies**. 2. Search for policies related to: * `constraints/logging.adminActivityService` * `constraints/logging.dataAccessService` 3. Edit and set them to **enforce** required logging for IAM services. *** This sequence ensures IAM configuration changes and access are fully logged and retained according to compliance requirements using only the GCP Console. Below are the steps to remediate “Audit Configuration Logging” issues for GCP IAM by enabling Audit Logs using the `gcloud` CLI. I’ll show it at the **project** level; you can adapt for folders/organization. *** ## 1. Set your target project ```bash theme={null} gcloud config set project PROJECT_ID ``` Replace `PROJECT_ID` with your project ID. *** ## 2. Export current IAM policy to a file ```bash theme={null} gcloud projects get-iam-policy PROJECT_ID \ --format=json > iam-policy.json ``` This creates `iam-policy.json` that you’ll edit to add `auditConfigs`. *** ## 3. Edit the IAM policy to add audit logging Open `iam-policy.json` in an editor and add or update the `auditConfigs` section. ### Example: Enable all audit log types for all services Add this top-level block (sibling to `"bindings"`): ```json theme={null} { "bindings": [ ... existing bindings here ... ], "auditConfigs": [ { "service": "allServices", "auditLogConfigs": [ { "logType": "ADMIN_READ" }, { "logType": "DATA_READ" }, { "logType": "DATA_WRITE" } ] } ] } ``` Notes: * `service: "allServices"` enables audit logging for every supported Google Cloud service. * `logType`s: * `ADMIN_READ` – read operations on configuration/resources. * `DATA_READ` – read access to user data. * `DATA_WRITE` – write access to user data. * If you need to exempt service accounts from specific logs, add: ```json theme={null} { "logType": "DATA_READ", "exemptedMembers": [ "user:alice@example.com", "serviceAccount:sa-name@PROJECT_ID.iam.gserviceaccount.com" ] } ``` Keep the rest of the file unchanged. *** ## 4. Re-apply the updated IAM policy ```bash theme={null} gcloud projects set-iam-policy PROJECT_ID iam-policy.json ``` Confirm that the command succeeds and doesn’t report invalid JSON or fields. *** ## 5. Verify the audit configuration ```bash theme={null} gcloud projects get-iam-policy PROJECT_ID \ --format=json | jq '.auditConfigs' ``` You should see the `allServices` audit configuration with `ADMIN_READ`, `DATA_READ`, and `DATA_WRITE`. *** ## 6. (Optional) Do the same at org/folder level **Organization:** ```bash theme={null} ORG_ID=123456789012 gcloud organizations get-iam-policy $ORG_ID --format=json > org-iam.json # Edit org-iam.json to add the same `auditConfigs` block gcloud organizations set-iam-policy $ORG_ID org-iam.json ``` **Folder:** ```bash theme={null} FOLDER_ID=345678901234 gcloud resource-manager folders get-iam-policy $FOLDER_ID --format=json > folder-iam.json # Edit folder-iam.json to add `auditConfigs` gcloud resource-manager folders set-iam-policy $FOLDER_ID folder-iam.json ``` *** These steps remediate audit configuration logging issues by ensuring IAM audit logs (Admin & Data) are enabled via the GCP CLI. Below are step‑by‑step instructions and a Python example to remediate missing **Audit Configuration Logging** for **GCP IAM** (i.e., enable Data Access audit logs via IAM `auditConfigs`). *** ## 1. Decide the Scope and Services First decide: * **Scope**: organization, folder, or project * Org: `organizations/1234567890` * Folder: `folders/34567890` * Project: `projects/my-project-id` or `projects/1234567890` * **Services** to log: * `"allServices"` (recommended) or specific services like `"iam.googleapis.com"` * **Log types**: * `"ADMIN_READ"`, `"DATA_READ"`, `"DATA_WRITE"`\ (Admin Activity logs are always on and free; Data Access logs can generate cost.) Example choice (recommended baseline): ```text theme={null} Scope: projects/my-project-id Service: allServices Log types: DATA_READ, DATA_WRITE ``` *** ## 2. Enable Required APIs Make sure the following APIs are enabled on the project you use to run the script: * Cloud Resource Manager API (`cloudresourcemanager.googleapis.com`) * IAM API (`iam.googleapis.com`) – not strictly necessary to update auditConfigs, but often used in tandem ```bash theme={null} gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com \ --project=YOUR-BILLING-PROJECT-ID ``` *** ## 3. Set Up Authentication Use a service account with **Owner** or at least: * `resourcemanager.organizations.setIamPolicy` or * `resourcemanager.projects.setIamPolicy` / `resourcemanager.folders.setIamPolicy` Authenticate locally: ```bash theme={null} gcloud auth application-default login ``` Your Python code will then pick up the ADC (Application Default Credentials). *** ## 4. Python Code: Enable Audit Config Logging This example: * Reads the current IAM policy at the scope. * Merges/updates the `auditConfigs` for `allServices`. * Ensures both `DATA_READ` and `DATA_WRITE` are enabled. * Writes the policy back. ```python theme={null} from googleapiclient import discovery from google.oauth2 import service_account import google.auth # ------------------------------------------------------------------- # 1. CONFIGURE YOUR TARGET RESOURCE # ------------------------------------------------------------------- # Examples: # resource = "organizations/1234567890" # resource = "folders/34567890" resource = "projects/my-project-id" # Service to configure: "allServices" or specific service(s), e.g. "iam.googleapis.com" TARGET_SERVICE = "allServices" LOG_TYPES_TO_ENABLE = ["DATA_READ", "DATA_WRITE"] # Add "ADMIN_READ" if needed # ------------------------------------------------------------------- # 2. BUILD THE CLOUD RESOURCE MANAGER CLIENT # ------------------------------------------------------------------- # If you have a service account JSON file: # credentials = service_account.Credentials.from_service_account_file("key.json") # crm = discovery.build("cloudresourcemanager", "v1", credentials=credentials) credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"]) crm = discovery.build("cloudresourcemanager", "v1", credentials=credentials) # ------------------------------------------------------------------- # 3. HELPER: MERGE/UPDATE AUDIT CONFIGS # ------------------------------------------------------------------- def merge_audit_configs(existing_audit_configs, target_service, log_types): """ Ensure that 'target_service' has all 'log_types' enabled in auditConfigs. Returns the updated auditConfigs list. """ if existing_audit_configs is None: existing_audit_configs = [] # Find existing config for the service service_config = None for ac in existing_audit_configs: if ac.get("service") == target_service: service_config = ac break if not service_config: service_config = {"service": target_service, "auditLogConfigs": []} existing_audit_configs.append(service_config) # Build a mapping of logType -> auditLogConfig existing_log_types = {c["logType"]: c for c in service_config.get("auditLogConfigs", [])} for lt in log_types: if lt not in existing_log_types: service_config.setdefault("auditLogConfigs", []).append({"logType": lt}) return existing_audit_configs # ------------------------------------------------------------------- # 4. GET CURRENT IAM POLICY # ------------------------------------------------------------------- get_req = crm.projects().getIamPolicy( # change to organizations().getIamPolicy or folders() if needed resource=resource, body={"options": {"requestedPolicyVersion": 3}} ) policy = get_req.execute() # ------------------------------------------------------------------- # 5. UPDATE AUDIT CONFIGS # ------------------------------------------------------------------- audit_configs = policy.get("auditConfigs") audit_configs = merge_audit_configs(audit_configs, TARGET_SERVICE, LOG_TYPES_TO_ENABLE) policy["auditConfigs"] = audit_configs # ------------------------------------------------------------------- # 6. WRITE BACK THE UPDATED POLICY # ------------------------------------------------------------------- set_req = crm.projects().setIamPolicy( # change to organizations().setIamPolicy or folders() if needed resource=resource, body={"policy": policy} ) updated_policy = set_req.execute() print("Updated IAM policy auditConfigs for:", resource) for ac in updated_policy.get("auditConfigs", []): print(ac) ``` ### Adjusting for Organization or Folder Change the client calls: * For **organization**: ```python theme={null} get_req = crm.organizations().getIamPolicy( resource="organizations/1234567890", body={"options": {"requestedPolicyVersion": 3}} ) set_req = crm.organizations().setIamPolicy( resource="organizations/1234567890", body={"policy": policy} ) ``` * For **folder**: ```python theme={null} get_req = crm.folders().getIamPolicy( resource="folders/34567890", body={"options": {"requestedPolicyVersion": 3}} ) set_req = crm.folders().setIamPolicy( resource="folders/34567890", body={"policy": policy} ) ``` *** ## 5. Verify in Cloud Console 1. Go to **IAM & Admin → Audit Logs**. 2. Select the **project / folder / organization**. 3. Confirm: * Service: `All services` (or the one you configured). * Log Types: **Data Read** and **Data Write** are enabled. *** If you tell me your exact scope (project/org) and whether you want all services or specific ones (like just IAM), I can tailor the code snippet precisely to that. ```hcl theme={null} resource "google_project_iam_audit_config" "project_audit_logging" { project = "YOUR_GCP_PROJECT_ID" # replace with your GCP project ID service = "allServices" audit_log_config { log_type = "ADMIN_READ" # exempted_members = ["user:EXEMPTED_USER@example.com"] # optional } audit_log_config { log_type = "DATA_READ" # exempted_members = ["user:EXEMPTED_USER@example.com"] # optional } audit_log_config { log_type = "DATA_WRITE" # exempted_members = ["user:EXEMPTED_USER@example.com"] # optional } } ``` For organization‑wide logging instead of per‑project, use: ```hcl theme={null} resource "google_organization_iam_audit_config" "org_audit_logging" { org_id = "YOUR_ORGANIZATION_ID" # replace with your GCP organization ID service = "allServices" audit_log_config { log_type = "ADMIN_READ" } audit_log_config { log_type = "DATA_READ" } audit_log_config { log_type = "DATA_WRITE" } } ``` This enables Cloud Audit Logs for all services and all log types at the project or organization level. Verification: `terraform plan` should show creation (or update) of the `google_project_iam_audit_config` or `google_organization_iam_audit_config` resource with `service = "allServices"` and the three `audit_log_config` blocks for `ADMIN_READ`, `DATA_READ`, and `DATA_WRITE`. ### Additional Reading: * [https://cloud.google.com/logging/docs/logs-based-metrics/](https://cloud.google.com/logging/docs/logs-based-metrics/)