Audit Logging Should Be Enabled And Shipped Off-Cluster

#!/usr/bin/env bash
# Audit: GKE API server audit logging and export status
# Requirements:
#   - gcloud installed and authenticated
#   - jq installed
#   - Appropriate IAM permissions on the project(s)

set -euo pipefail

# -------- CONFIGURATION --------
# Space-separated list of projects to check
PROJECTS="<PUT_PROJECT_IDS_HERE>"

# Optional: restrict to specific locations (space-separated)
# Leave empty to scan all locations
LOCATIONS=""

# Optional: restrict to specific cluster types
# Valid values include: ZONAL_REGIONAL_AUTOPILOT
CLUSTER_TYPES=""

echo "Checking GKE API audit logging and export status..."
echo "Timestamp: $(date -Iseconds)"
echo

for PROJECT in $PROJECTS; do
  echo "=== Project: ${PROJECT} ==="

  # 1) Cluster-level: check if Kubernetes API audit logging is enabled
  echo "--- Cluster-level Kubernetes API audit logging ---"
  CLUSTER_CMD=(gcloud container clusters list
    --project "${PROJECT}"
    --format=json)

  # Apply optional filters
  if [ -n "${LOCATIONS}" ]; then
    # gcloud doesn't filter by location directly in list; we'll filter later in jq
    :
  fi
  if [ -n "${CLUSTER_TYPES}" ]; then
    # Same: filter in jq
    :
  fi

  CLUSTERS_JSON="$("${CLUSTER_CMD[@]}" || echo "[]")"

  if [ "${CLUSTERS_JSON}" = "[]" ]; then
    echo "No clusters found in project ${PROJECT}"
  else
    echo "${CLUSTERS_JSON}" | jq -r '
      .[] 
      | . as $c
      | (
          "Cluster: \($c.name)",
          "  Location: \($c.location)",
          "  Logging service: \($c.loggingService // "default")",
          "  Logging config.enabledComponents: \(
             ( $c.loggingConfig.enabledComponents // [] ) 
             | join(", ")
            )",
          "  API server audit logs enabled: \(
             if ($c.loggingConfig.enabledComponents // []) 
                | index("APISERVER_AUDIT") 
             then "YES" else "NO" end
            )",
          ""
        )
    '

    echo "Clusters with API server audit logging DISABLED:"
    echo "${CLUSTERS_JSON}" | jq -r '
      .[]
      | select( (.loggingConfig.enabledComponents // []) | index("APISERVER_AUDIT") | not )
      | "  - " + .name + " (" + .location + ")"
    ' || true
  fi

  echo

  # 2) Project-level: check if audit logs are being exported off-cluster
  #    We consider “off-cluster” as:
  #      - Log sinks that include gke.googleapis.com%2Fmaster (API server logs)
  #      - Destination is not just Cloud Logging default; e.g. BigQuery / Cloud Storage / Pub/Sub
  echo "--- Project-level log sinks for API audit logs (off-cluster export) ---"

  SINKS_JSON="$(gcloud logging sinks list \
    --project "${PROJECT}" \
    --format=json || echo "[]")"

  if [ "${SINKS_JSON}" = "[]" ]; then
    echo "No log sinks defined in project ${PROJECT}"
  else
    echo "${SINKS_JSON}" | jq -r '
      .[]
      | . as $s
      | (
          "Sink: \($s.name)",
          "  Destination: \($s.destination)",
          "  Filter: \($s.filter // "<none>")",
          "  Includes GKE master / API logs: \(
             if ($s.filter // "") 
                | test("gke.googleapis.com%2Fmaster|k8s|kubernetes|container.googleapis.com")
             then "LIKELY" else "UNCLEAR/NO" end
            )",
          ""
        )
    '

    echo "Sinks that LIKELY export GKE master/API logs off-cluster:"
    echo "${SINKS_JSON}" | jq -r '
      .[]
      | select(
          (.filter // "") 
          | test("gke.googleapis.com%2Fmaster|k8s|kubernetes|container.googleapis.com")
        )
      | "  - " + .name + " -> " + .destination
    ' || true
  fi

  echo
done

cat <<'EOF'

INTERPRETING RESULTS
--------------------

1) Cluster-level section:
   - For each cluster, look at:
       API server audit logs enabled: YES/NO
   - PROBLEM:
       - Any cluster showing:
           API server audit logs enabled: NO
       means Kubernetes API audit logging is not enabled for that cluster.

2) Project-level sink section:
   - PROBLEM:
       - No log sinks defined in the project, or
       - Sinks exist but "Includes GKE master / API logs" is "UNCLEAR/NO" for all sinks, or
       - Sinks that include these logs only send to destinations that are not considered
         tamper-resistant for your requirements.
   - You should be able to identify at least one sink where:
       - Includes GKE master / API logs: LIKELY
       - Destination is a controlled, tamper-resistant store (e.g. Cloud Storage with
         restricted IAM, BigQuery dataset with retention policy, or Pub/Sub feeding a
         central SIEM).

This script only reports state. Enabling audit logging and configuring export
must be done via GKE/Cloud Logging configuration (console, gcloud, or IaC).
EOF