> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud Audit Logging Should Be Enabled ### More Info: Ensure that Cloud Audit Logging is configured properly across all services and all users from a project. ### Risk Level Medium ### Address Security ### Compliance Standards * CIS GCP * CIS GCP 2.0.0 * Cloudanix Best Practice * FedRAMP * GDPR * HIPAA * ISO 27001 * NIST * NIST CSF * PCI * Reserve Bank of India (RBI) Cyber Security Framework * Reserve Bank of India (RBI) Master Direction – Information Technology Framework * SOC2 * Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework ### Triage and Remediation ### Remediation To remediate the "Cloud Audit Logging Should Be Enabled" misconfiguration for GCP using the GCP console, follow the steps below: 1. Open the GCP Console and navigate to the project for which you want to enable audit logging. 2. Click on the "Navigation Menu" button in the top left corner of the console and select "Logging" under the "TOOLS" section. 3. In the Logging page, click on the "Log-based Metrics" tab. 4. Click on the "+ CREATE METRIC" button to create a new metric. 5. In the "Create a Metric" page, enter a name for the metric (e.g., "audit-logs"), select "Admin Activity" under the "Log" dropdown menu, and select "Global" under the "Resource type" dropdown menu. 6. Click on the "CREATE METRIC" button to create the metric. 7. Click on the "Create Sink" button to create a new sink. 8. In the "Create a Sink" page, enter a name for the sink (e.g., "audit-logs-sink"), select "BigQuery" under the "Sink Service" dropdown menu, and select the destination dataset and table where you want to store the audit logs. 9. Click on the "CREATE SINK" button to create the sink. 10. Click on the "View Sink" button to view the sink details. 11. In the sink details page, click on the "EDIT" button to edit the sink configuration. 12. In the "Edit a Sink" page, select "Include All Logs" under the "Filter" section and select the metric you created earlier under the "Log Metric" section. 13. Click on the "SAVE" button to save the sink configuration. 14. You have now enabled audit logging for your GCP project. The audit logs will be stored in the destination BigQuery table you specified in the sink configuration. # To remediate the misconfiguration "Cloud Audit Logging should be enabled" for GCP using GCP CLI, follow the below steps: 1. Open the Cloud Shell in the GCP console or install the GCP CLI on your local machine. 2. Run the following command to enable Cloud Audit Logging for all services in your project: ``` gcloud logging project-config set \ audit_configs: \ - service: allServices \ audit_log_configs: \ - log_type: ADMIN_READ \ exempted_members: \ - user:example-user@domain.com \ - group:example-group@domain.com \ - domain:example.com \ - log_type: DATA_READ \ - log_type: DATA_WRITE \ ``` 3. Replace the exempted\_members field with the email addresses or domains of the users or groups that should be exempt from audit logging. 4. Run the following command to verify that Cloud Audit Logging is enabled: ``` gcloud logging project-config describe ``` 5. Check the output for the following line: ``` "cloudAuditLogsEnabled": true ``` If the value is true, then Cloud Audit Logging is enabled for your project. By following these steps, you can successfully remediate the misconfiguration "Cloud Audit Logging should be enabled" for GCP using GCP CLI. To remediate the misconfiguration "Cloud Audit Logging Should Be Enabled" for GCP using Python, you can follow the below steps: 1. Import the required libraries: ```python theme={null} from googleapiclient import discovery from oauth2client.client import GoogleCredentials ``` 2. Authenticate and create a client object: ```python theme={null} credentials = GoogleCredentials.get_application_default() service = discovery.build('logging', 'v2', credentials=credentials) ``` 3. Create a sink object for the logs to be collected: ```python theme={null} sink_name = 'my-sink' destination_uri = 'storage.googleapis.com/my-bucket' filter = 'logName:syslog' sink = { 'name': sink_name, 'destination': destination_uri, 'filter': filter } ``` 4. Check if the sink already exists: ```python theme={null} sinks = service.sinks().list(project='my-project-id').execute() if sink_name in [s['name'] for s in sinks['sinks']]: print(f"Sink {sink_name} already exists.") else: # Create the sink service.sinks().create( body=sink, parent=f"projects/my-project-id" ).execute() print(f"Sink {sink_name} created.") ``` 5. Enable audit logging for the project: ```python theme={null} service.projects().updateAuditConfig( body={ 'auditConfig': { 'service': 'allServices', 'auditLogConfigs': [{ 'logName': 'projects/my-project-id/logs/cloudaudit.googleapis.com', 'exemptedMembers': [], 'ignoreChildExemptions': True, 'enabled': True }] } }, resource='projects/my-project-id' ).execute() ``` This will enable audit logging for the GCP project and create a sink to collect the logs in a specified bucket. You can modify the sink name, destination URI, and filter as per your requirement. ```hcl theme={null} # NOTE: This finding cannot be remediated on a google_logging_metric resource. # A logging metric only counts/filters logs; it does not enable Cloud Audit Logging. # Cloud Audit Logging is enabled via IAM audit configs on the project/folder/org. resource "google_project_iam_audit_config" "project_audit_logging" { project = "YOUR_PROJECT_ID" # replace with your GCP project ID service = "allServices" audit_log_config { log_type = "ADMIN_READ" # Optional: exempt specific members from ADMIN_READ logs # exempted_members = [ # "user:EXEMPTED_USER@EXAMPLE.COM", # ] } audit_log_config { log_type = "DATA_READ" # Optional: exempt specific members from DATA_READ logs # exempted_members = [ # "user:EXEMPTED_USER@EXAMPLE.COM", # ] } audit_log_config { log_type = "DATA_WRITE" # Optional: exempt specific members from DATA_WRITE logs # exempted_members = [ # "user:EXEMPTED_USER@EXAMPLE.COM", # ] } } ``` Cloud Audit Logging cannot be turned on or configured via `google_logging_metric`; you must use IAM audit configs (`google_project_iam_audit_config`, or the folder/organization equivalents) in Terraform or configure it in the Cloud Console under IAM & Admin → Audit Logs. For verification, `terraform plan` should show a new `google_project_iam_audit_config.project_audit_logging` resource being created (or updated) with `service = "allServices"` and three `audit_log_config` blocks for `ADMIN_READ`, `DATA_READ`, and `DATA_WRITE`.