> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Audit logging enabled remediation

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate “Audit Logging not enabled” for GCP IAM using the GCP Console:

        1. **Go to the GCP Console**
           * Open: [https://console.cloud.google.com](https://console.cloud.google.com)
           * Make sure you’ve selected the correct **Project** (or **Folder/Organization**) at the top.

        2. **Open Audit Logs settings**
           * In the left-hand menu, go to:\
             **IAM & Admin → Audit Logs**

        3. **Select the resource scope**
           * At the top of the page, use the drop-down to choose the scope you want to configure:
             * **Organization** (preferred for centralized control), or
             * **Folder**, or
             * **Project**

        4. **Filter to IAM-related services**\
           In the service list, locate and configure at least:

           * `IAM Service`
           * `IAM Service Account`
           * `Cloud Resource Manager` (often also important for IAM-like changes, e.g., project bindings)

           You can use the filter box to search for “IAM”.

        5. **Enable the desired audit log types**\
           For each of the relevant services (e.g., IAM Service):
           * Click the service name (or checkbox, depending on UI version).
           * On the right (or in the panel that appears), enable the log types you need by checking:
             * **Admin Read** – controls/reads IAM policies, roles, etc.
             * **Data Read** – reads of data (less relevant specifically for IAM, but good to have if required by policy).
             * **Data Write** – changes to data/resources (e.g., policy updates, role bindings).
           * For strict security/compliance, enable **all three** for applicable principals:
             * You’ll see columns like **All users**, **Admin**, **Service accounts**, etc. Ensure these are checked according to your org’s policy (many orgs enable for **All principals**).

        6. **Save the configuration**
           * After selecting the log types, click **Save** at the bottom/right of the panel.

        7. **Verify logs are being written**
           * Go to **Logging → Logs Explorer**.
           * In the query builder, filter by:
             * `resource.type="project"` (or org/folder type as appropriate)
             * `logName:"cloudaudit.googleapis.com"`
           * Make a small IAM change (e.g., add/remove a test role) and confirm an **AuditLog** entry appears.

        Once these steps are complete, IAM audit logging is enabled and the “Audit Logging Enabled” misconfiguration for GCP IAM should be remediated for that scope.
      </Accordion>

      <Accordion title="Using CLI">
        In GCP, “Audit Logging enabled” for IAM usually means **Data Access audit logs** are turned on (Admin Activity logs are always on). You enable these by adding `auditConfigs` to the IAM policy using `gcloud`.

        Below is how to do it with GCP CLI at the **project** level (similar for folder/org).

        ***

        ### 1. Set environment variables

        ```bash theme={null}
        PROJECT_ID="my-project-id"
        gcloud config set project "$PROJECT_ID"
        ```

        ***

        ### 2. Export current IAM policy to a file

        ```bash theme={null}
        gcloud projects get-iam-policy "$PROJECT_ID" \
          --format=json > iam-policy.json
        ```

        ***

        ### 3. Edit the IAM policy to add auditConfigs

        Open `iam-policy.json` in an editor and add an `auditConfigs` block at the top level (sibling to `bindings`).\
        Example to enable all Data Access logs for all services and no exemptions:

        ```jsonc theme={null}
        {
          "bindings": [
            ...
          ],
          "auditConfigs": [
            {
              "service": "allServices",
              "auditLogConfigs": [
                {
                  "logType": "DATA_READ"
                },
                {
                  "logType": "DATA_WRITE"
                },
                {
                  "logType": "ADMIN_READ"
                }
              ]
            }
          ],
          "etag": "..."
        }
        ```

        Notes:

        * Keep the existing `etag` unchanged.
        * If `auditConfigs` already exists, merge your desired `auditLogConfigs` instead of overwriting unrelated entries.
        * You can also set for a specific service, e.g. `"service": "iam.googleapis.com"` instead of `"allServices"`.

        ***

        ### 4. Apply the updated IAM policy

        ```bash theme={null}
        gcloud projects set-iam-policy "$PROJECT_ID" iam-policy.json
        ```

        Confirm the updated policy:

        ```bash theme={null}
        gcloud projects get-iam-policy "$PROJECT_ID" --format=json | jq '.auditConfigs'
        ```

        ***

        ### 5. (Optional) Do the same at folder / org level

        For a folder:

        ```bash theme={null}
        FOLDER_ID="123456789012"
        gcloud resource-manager folders get-iam-policy "$FOLDER_ID" --format=json > folder-iam.json
        # edit folder-iam.json to add auditConfigs as above
        gcloud resource-manager folders set-iam-policy "$FOLDER_ID" folder-iam.json
        ```

        For an org:

        ```bash theme={null}
        ORG_ID="123456789012"
        gcloud organizations get-iam-policy "$ORG_ID" --format=json > org-iam.json
        # edit org-iam.json
        gcloud organizations set-iam-policy "$ORG_ID" org-iam.json
        ```

        This enables IAM Data Access audit logging via CLI in GCP.
      </Accordion>

      <Accordion title="Using Python">
        To remediate “Audit Logging not enabled” for GCP IAM using Python, you need to update the project’s IAM policy to include `auditConfigs` for the services you care about (e.g., `allServices`) and log types (ADMIN\_READ, DATA\_READ, DATA\_WRITE).

        Below is a minimal, step‑by‑step example using the `google-api-python-client` library.

        ***

        ### 1. Prerequisites

        1. Enable these APIs on the project:
           * IAM Service: `iam.googleapis.com`
           * Cloud Resource Manager API: `cloudresourcemanager.googleapis.com`
        2. Install libraries:
           ```bash theme={null}
           pip install google-api-python-client google-auth google-auth-httplib2 google-auth-oauthlib
           ```
        3. Authenticate with an identity that has `resourcemanager.projects.setIamPolicy` and `resourcemanager.projects.getIamPolicy` (e.g., Owner or Security Admin):
           ```bash theme={null}
           gcloud auth application-default login
           ```

        ***

        ### 2. Decide what to log

        Common secure baseline for all services:

        * `ADMIN_READ`
        * `DATA_READ`
        * `DATA_WRITE`

        Optionally include `exemptedMembers` if some principals must be excluded from logging.

        ***

        ### 3. Python: Enable Audit Logging on a Project

        ```python theme={null}
        from google.oauth2 import service_account
        from googleapiclient import discovery
        from googleapiclient.errors import HttpError
        import google.auth

        # -------------------------------------------------------------------
        # CONFIG
        # -------------------------------------------------------------------
        PROJECT_ID = "your-project-id"  # <-- change this
        ENABLE_ADMIN_READ = True
        ENABLE_DATA_READ = True
        ENABLE_DATA_WRITE = True

        # If using ADC (gcloud auth application-default login), just call default():
        credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])

        # Alternatively, use a service account key:
        # credentials = service_account.Credentials.from_service_account_file(
        #     "path/to/key.json",
        #     scopes=["https://www.googleapis.com/auth/cloud-platform"],
        # )

        service = discovery.build("cloudresourcemanager", "v1", credentials=credentials)


        def build_audit_config():
            log_types = []
            if ENABLE_ADMIN_READ:
                log_types.append("ADMIN_READ")
            if ENABLE_DATA_READ:
                log_types.append("DATA_READ")
            if ENABLE_DATA_WRITE:
                log_types.append("DATA_WRITE")

            if not log_types:
                return []

            # Example: apply to all services
            return [{
                "service": "allServices",
                "auditLogConfigs": [
                    {
                        "logType": log_type,
                        # Optional: exempt some members from logging
                        # "exemptedMembers": ["user:someone@example.com"]
                    }
                    for log_type in log_types
                ],
            }]


        def main():
            project_resource = f"projects/{PROJECT_ID}"

            try:
                # 1. Get current IAM policy
                policy = service.projects().getIamPolicy(
                    resource=project_resource,
                    body={"options": {"requestedPolicyVersion": 3}},
                ).execute()

                current_audit_configs = policy.get("auditConfigs", [])
                new_audit_config = build_audit_config()

                # Replace or merge auditConfigs. Here we simply replace configs for "allServices".
                # If you need to merge per service, add merging logic instead.
                # ---- Simple replace strategy ----
                other_configs = [ac for ac in current_audit_configs if ac.get("service") != "allServices"]
                policy["auditConfigs"] = other_configs + new_audit_config

                # 2. Set updated IAM policy
                set_req = service.projects().setIamPolicy(
                    resource=project_resource,
                    body={"policy": policy},
                )
                updated_policy = set_req.execute()

                print("Updated IAM policy auditConfigs:")
                print(updated_policy.get("auditConfigs", []))

            except HttpError as e:
                print(f"Error updating IAM policy: {e}")


        if __name__ == "__main__":
            main()
        ```

        ***

        ### 4. Verify in Console

        1. Go to: IAM & Admin → Audit Logs → Select project.
        2. Confirm that for “All services” (or specific services), the chosen log types (Admin, Data read/write) are enabled.
        3. Optionally check Cloud Logging → Logs Explorer for `cloudaudit.googleapis.com` logs.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        # Enable Cloud Audit Logs for all services and log types on a project.
        # Substitute YOUR_PROJECT_ID with your GCP project ID.
        resource "google_project_iam_audit_config" "all_services_audit_logging" {
          project = "YOUR_PROJECT_ID"

          service = "allServices"

          audit_log_config {
            log_type = "ADMIN_READ"
          }

          audit_log_config {
            log_type = "DATA_READ"
          }

          audit_log_config {
            log_type = "DATA_WRITE"
          }
        }
        ```

        Replace `YOUR_PROJECT_ID` with your actual project ID.\
        This updates the IAM audit logging configuration in place; it does not recreate the project or other resources.

        For verification, `terraform plan` should show an update to `google_project_iam_audit_config.all_services_audit_logging` adding the three `audit_log_config` blocks (ADMIN\_READ, DATA\_READ, DATA\_WRITE).
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>