Logging Should Be Enabled
More Info:
Ensures all Kubernetes clusters have logging enabled. This setting should be enabled to ensure Kubernetes control plane logs are properly recorded.Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSSTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Logging Should Be Enabled” for GCP using GCP console, please follow the below steps:
- Login to GCP console (https://console.cloud.google.com/).
- Select the project for which you want to enable logging.
- In the left navigation menu, select “Logging”.
- Click on “Log Exports” tab.
- Click on “Create Export” button.
- Select the logs which you want to export to Stackdriver Logging.
- Choose the destination where you want to export logs to (e.g. BigQuery, Pub/Sub, Cloud Storage).
- Configure the export settings as per your requirement.
- Click on “Create” button.
Using CLI
Using CLI
To remediate the misconfiguration “Logging Should Be Enabled” for GCP using GCP CLI, follow these steps:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to enable Stackdriver Logging for all resources in the current project:
-
If you want to enable Stackdriver Logging for a specific resource, run the following command:
Replace
<resource-type>with the type of resource (e.g.gce_instance,cloud_function) and<resource-name>with the name of the resource. - Verify that Stackdriver Logging is enabled by going to the Logging page in the GCP Console. You should see logs for the resources that you enabled logging for.
- Repeat steps 2-4 for all projects and resources in your GCP environment to ensure that logging is enabled for all resources.
Using Python
Using Python
To remediate the misconfiguration “Logging should be enabled” for GCP using Python, you can follow the below steps:
- First, you need to create a service account with the required permissions to enable logging. You can create a service account using the GCP console or using the following Python code:
- Next, you need to enable logging for the GCP project. You can use the
google-cloud-logginglibrary to enable logging using the following Python code:
-
Replace
project_idwith the ID of the GCP project for which you want to enable logging. - Finally, run the Python script to enable logging for the GCP project.