Skip to main content

Audit Logging Enabled Remediation

Triage and Remediation​

Remediation​

Using Console

To remediate “Audit Logging not enabled” for GCP IAM using the GCP Console:

  1. Go to the GCP Console

  2. Open Audit Logs settings

    • In the left-hand menu, go to:
      IAM & Admin → Audit Logs

  3. Select the resource scope

    • At the top of the page, use the drop-down to choose the scope you want to configure:
      • Organization (preferred for centralized control), or
      • Folder, or
      • Project

  4. Filter to IAM-related services
    In the service list, locate and configure at least:

    • IAM Service
    • IAM Service Account
    • Cloud Resource Manager (often also important for IAM-like changes, e.g., project bindings)

    You can use the filter box to search for “IAM”.

  5. Enable the desired audit log types
    For each of the relevant services (e.g., IAM Service):

    • Click the service name (or checkbox, depending on UI version).
    • On the right (or in the panel that appears), enable the log types you need by checking:
      • Admin Read – controls/reads IAM policies, roles, etc.
      • Data Read – reads of data (less relevant specifically for IAM, but good to have if required by policy).
      • Data Write – changes to data/resources (e.g., policy updates, role bindings).
    • For strict security/compliance, enable all three for applicable principals:
      • You’ll see columns like All users, Admin, Service accounts, etc. Ensure these are checked according to your org’s policy (many orgs enable for All principals).

  6. Save the configuration

    • After selecting the log types, click Save at the bottom/right of the panel.

  7. Verify logs are being written

    • Go to Logging → Logs Explorer.
    • In the query builder, filter by:
      • resource.type="project" (or org/folder type as appropriate)
      • logName:"cloudaudit.googleapis.com"
    • Make a small IAM change (e.g., add/remove a test role) and confirm an AuditLog entry appears.

Once these steps are complete, IAM audit logging is enabled and the “Audit Logging Enabled” misconfiguration for GCP IAM should be remediated for that scope.

Using CLI

In GCP, “Audit Logging enabled” for IAM usually means Data Access audit logs are turned on (Admin Activity logs are always on). You enable these by adding auditConfigs to the IAM policy using gcloud.

Below is how to do it with GCP CLI at the project level (similar for folder/org).

1. Set environment variables​

PROJECT_ID="my-project-id"
gcloud config set project "$PROJECT_ID"

2. Export current IAM policy to a file​

gcloud projects get-iam-policy "$PROJECT_ID" \
  --format=json > iam-policy.json

3. Edit the IAM policy to add auditConfigs​

Open iam-policy.json in an editor and add an auditConfigs block at the top level (sibling to bindings).
Example to enable all Data Access logs for all services and no exemptions:

{
  "bindings": [
    ...
  ],
  "auditConfigs": [
    {
      "service": "allServices",
      "auditLogConfigs": [
        {
          "logType": "DATA_READ"
        },
        {
          "logType": "DATA_WRITE"
        },
        {
          "logType": "ADMIN_READ"
        }
      ]
    }
  ],
  "etag": "..."
}

Notes:

  • Keep the existing etag unchanged.
  • If auditConfigs already exists, merge your desired auditLogConfigs instead of overwriting unrelated entries.
  • You can also set for a specific service, e.g. "service": "iam.googleapis.com" instead of "allServices".

4. Apply the updated IAM policy​

gcloud projects set-iam-policy "$PROJECT_ID" iam-policy.json

Confirm the updated policy:

gcloud projects get-iam-policy "$PROJECT_ID" --format=json | jq '.auditConfigs'

5. (Optional) Do the same at folder / org level​

For a folder:

FOLDER_ID="123456789012"
gcloud resource-manager folders get-iam-policy "$FOLDER_ID" --format=json > folder-iam.json
# edit folder-iam.json to add auditConfigs as above
gcloud resource-manager folders set-iam-policy "$FOLDER_ID" folder-iam.json

For an org:

ORG_ID="123456789012"
gcloud organizations get-iam-policy "$ORG_ID" --format=json > org-iam.json
# edit org-iam.json
gcloud organizations set-iam-policy "$ORG_ID" org-iam.json

This enables IAM Data Access audit logging via CLI in GCP.

Using Python

To remediate “Audit Logging not enabled” for GCP IAM using Python, you need to update the project’s IAM policy to include auditConfigs for the services you care about (e.g., allServices) and log types (ADMIN_READ, DATA_READ, DATA_WRITE).

Below is a minimal, step‑by‑step example using the google-api-python-client library.

1. Prerequisites​

  1. Enable these APIs on the project:
    • IAM Service: iam.googleapis.com
    • Cloud Resource Manager API: cloudresourcemanager.googleapis.com
  2. Install libraries: 
    pip install google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib
  3. Authenticate with an identity that has resourcemanager.projects.setIamPolicy and resourcemanager.projects.getIamPolicy (e.g., Owner or Security Admin): 
    gcloud auth application-default login

2. Decide what to log​

Common secure baseline for all services:

  • ADMIN_READ
  • DATA_READ
  • DATA_WRITE

Optionally include exemptedMembers if some principals must be excluded from logging.

3. Python: Enable Audit Logging on a Project​

from google.oauth2 import service_account
from googleapiclient import discovery
from googleapiclient.errors import HttpError
import google.auth

# -------------------------------------------------------------------
# CONFIG
# -------------------------------------------------------------------
PROJECT_ID = "your-project-id"  # <-- change this
ENABLE_ADMIN_READ = True
ENABLE_DATA_READ = True
ENABLE_DATA_WRITE = True

# If using ADC (gcloud auth application-default login), just call default():
credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])

# Alternatively, use a service account key:
# credentials = service_account.Credentials.from_service_account_file(
#     "path/to/key.json",
#     scopes=["https://www.googleapis.com/auth/cloud-platform"],
# )

service = discovery.build("cloudresourcemanager", "v1", credentials=credentials)


def build_audit_config():
    log_types = []
    if ENABLE_ADMIN_READ:
        log_types.append("ADMIN_READ")
    if ENABLE_DATA_READ:
        log_types.append("DATA_READ")
    if ENABLE_DATA_WRITE:
        log_types.append("DATA_WRITE")

    if not log_types:
        return []

    # Example: apply to all services
    return [{
        "service": "allServices",
        "auditLogConfigs": [
            {
                "logType": log_type,
                # Optional: exempt some members from logging
                # "exemptedMembers": ["user:someone@example.com"]
            }
            for log_type in log_types
        ],
    }]


def main():
    project_resource = f"projects/{PROJECT_ID}"

    try:
        # 1. Get current IAM policy
        policy = service.projects().getIamPolicy(
            resource=project_resource,
            body={"options": {"requestedPolicyVersion": 3}},
        ).execute()

        current_audit_configs = policy.get("auditConfigs", [])
        new_audit_config = build_audit_config()

        # Replace or merge auditConfigs. Here we simply replace configs for "allServices".
        # If you need to merge per service, add merging logic instead.
        # ---- Simple replace strategy ----
        other_configs = [ac for ac in current_audit_configs if ac.get("service") != "allServices"]
        policy["auditConfigs"] = other_configs + new_audit_config

        # 2. Set updated IAM policy
        set_req = service.projects().setIamPolicy(
            resource=project_resource,
            body={"policy": policy},
        )
        updated_policy = set_req.execute()

        print("Updated IAM policy auditConfigs:")
        print(updated_policy.get("auditConfigs", []))

    except HttpError as e:
        print(f"Error updating IAM policy: {e}")


if __name__ == "__main__":
    main()

4. Verify in Console​

  1. Go to: IAM & Admin → Audit Logs → Select project.
  2. Confirm that for “All services” (or specific services), the chosen log types (Admin, Data read/write) are enabled.
  3. Optionally check Cloud Logging → Logs Explorer for cloudaudit.googleapis.com logs.
Using Terraform
# Enable Cloud Audit Logs for all services and log types on a project.
# Substitute YOUR_PROJECT_ID with your GCP project ID.
resource "google_project_iam_audit_config" "all_services_audit_logging" {
  project = "YOUR_PROJECT_ID"

  service = "allServices"

  audit_log_config {
    log_type = "ADMIN_READ"
  }

  audit_log_config {
    log_type = "DATA_READ"
  }

  audit_log_config {
    log_type = "DATA_WRITE"
  }
}

Replace YOUR_PROJECT_ID with your actual project ID.
This updates the IAM audit logging configuration in place; it does not recreate the project or other resources.

For verification, terraform plan should show an update to google_project_iam_audit_config.all_services_audit_logging adding the three audit_log_config blocks (ADMIN_READ, DATA_READ, DATA_WRITE).