Project Ownership Change Log Alerts Should Be Enabled
More Info:
Ensures that logging and log alerts exist for project ownership assignments and changes. Project Ownership is the highest level of privilege on a project, any changes in project ownership should be heavily monitored to prevent unauthorized changes.Risk Level
HighAddress
SecurityCompliance Standards
CISGCP, CBP, HIPAA, ISO27001, HITRUSTTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Project Ownership Change Log Alerts Should Be Enabled” for GCP using GCP console, follow the below steps:
- Login to the GCP console.
- Navigate to the “Logging” section from the left-hand menu.
- In the “Logging” section, click on “Logs Explorer”.
- In the “Logs Explorer” page, select the “Resource” dropdown and select the project for which you want to enable the ownership change log alerts.
- In the search bar, type “project ownership change” and press enter.
- From the search results, select “Admin Activity” and then select “Project Ownership Change”.
- Click on “Create Metric” and give a name to the metric.
- Click on “Create Alert” and configure the alert as per your requirement.
- Click on “Save” to save the alert configuration.
Using CLI
Using CLI
To remediate the misconfiguration “Project Ownership Change Log Alerts Should Be Enabled” in GCP using GCP CLI, please follow the below steps:
- Open the Cloud Shell in the GCP console.
-
Run the following command to enable project ownership change log alerts:
This command creates a new sink named
PROJECT_OWNERSHIP_CHANGE_ALERTSthat sends log entries matching the specified filter to a Pub/Sub topic namedgcp-logging-alerts. -
Run the following command to create a new Pub/Sub subscription for the
gcp-logging-alertstopic:This command creates a new subscription namedPROJECT_OWNERSHIP_CHANGE_ALERTSfor thegcp-logging-alertstopic with an acknowledgement deadline of 30 seconds and no expiration period. -
Run the following command to create a new Cloud Function that processes the log entries sent to the
gcp-logging-alertstopic:This command deploys a new Cloud Function namedprocess_project_ownership_change_alertsthat processes log entries sent to thegcp-logging-alertstopic. The function is triggered by messages sent to the topic and has a memory limit of 128MB, a timeout of 30 seconds, and uses theenv.yamlfile to set environment variables. - Verify that the alerts are working by changing the ownership of a project in GCP. You should receive an alert in the Pub/Sub topic and the Cloud Function should process the log entry.
Using Python
Using Python
To remediate the misconfiguration “Project Ownership Change Log Alerts Should Be Enabled” for GCP using Python, you can follow the below steps:
-
First, you need to import the necessary libraries. You can use the Google Cloud Client Library for Python to interact with GCP APIs. Install the library using the following command:
-
Once you have installed the library, you need to authenticate your application. You can authenticate using a service account by setting the
GOOGLE_APPLICATION_CREDENTIALSenvironment variable to the path of the service account key file. -
After authentication, you can use the
google.cloud.monitoring_v3.MetricServiceClientclass to enable the “Project Ownership Change Log Alerts”. Use thecreate_alert_policymethod to create a new alert policy for the metricgce_instance_update. - After executing the above code, the “Project Ownership Change Log Alerts” will be enabled for your GCP project.