Cloud Sql System Event Audit Logging Should Be Enabled
More Info:
Ensure that Cloud SQL System Event Audit Logging is configured properly across all projects.Risk Level
MediumAddress
SecurityCompliance Standards
HITRUST, SOC2, NISTCSF, PCIDSS, CISGCP, CBP, HIPAA, ISO27001Triage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration “Cloud SQL System Event Audit Logging Should Be Enabled” in GCP using GCP console, you can follow the below steps:
- Open the GCP Console and navigate to the Cloud SQL instances page.
- Select the instance for which you want to enable audit logging.
- Click on the “Edit” button at the top of the page.
- Scroll down to the “Data Access” section and click on “Advanced Configuration”.
- Under “Audit Configuration”, select the checkbox for “System Event Audit Logs”.
- Click on the “Save” button at the bottom of the page to apply the changes.
- Verify that the audit logging is enabled by checking the “Audit Logs” tab in the Cloud SQL instance details page.
Using CLI
Using CLI
To remediate the misconfiguration “Cloud SQL System Event Audit Logging Should Be Enabled” for GCP using GCP CLI, follow the below steps:Note: Replace [INSTANCE_NAME] with the name of your Cloud SQL instance.
- Open the Cloud Shell in the GCP console.
- Run the following command to update the Cloud SQL instance to enable system event audit logging:
- After executing the command, verify that the system event audit logging is enabled by running the following command:
- In the output, check the value of the “databaseFlags” field. It should contain “log_system_events: on” indicating that the system event audit logging is enabled.
Using Python
Using Python
To remediate the misconfiguration “Cloud SQL system event audit logging should be enabled” in GCP using Python, you can follow the below steps:By following these steps, you can remediate the misconfiguration “Cloud SQL system event audit logging should be enabled” in GCP using Python.
- First, you need to authenticate and authorize the application to access the GCP project. You can do this by following the instructions in the Google Cloud documentation.
- Once you have authenticated and authorized the application, you need to import the required libraries in your Python code. You will need the following libraries:
- Next, you need to create a service account key for the GCP project. You can do this by following the instructions in the Google Cloud documentation.
- Once you have created the service account key, you need to download the key and save it in a secure location.
- In your Python code, you can use the service account key to authenticate and authorize the application to access the GCP project. You can do this by using the following code:
- After you have authenticated and authorized the application, you can use the
serviceobject to retrieve the configuration of the Cloud SQL instance. You can do this by using the following code:
- Once you have retrieved the configuration of the Cloud SQL instance, you can check if system event audit logging is enabled. You can do this by checking the value of the
settings.settingsVersionfield in theinstanceobject. If the value is2, then system event audit logging is enabled. If the value is1, then system event audit logging is not enabled.
- To enable system event audit logging, you need to update the configuration of the Cloud SQL instance. You can do this by using the following code:
- After you have updated the configuration of the Cloud SQL instance, you can verify that system event audit logging is enabled by checking the value of the
settings.settingsVersionfield in theinstanceobject.