Skip to main content

VPC Firewall Rule Logging Remediation

Triage and Remediation​

Remediation​

Using Console

To remediate the misconfiguration "Firewall Change Log Alerts Should Be Enabled" for GCP using GCP console, follow the below steps:

  1. Login to your GCP console.
  2. Navigate to the Security Command Center.
  3. Click on the "Security Health Analytics" option from the left-hand menu.
  4. Click on the "Firewall rules" option.
  5. Select the project for which you want to enable Firewall Change Log Alerts.
  6. Click on the "Edit" button.
  7. Scroll down to the "Logging" section and enable the "Firewall Change Log" option.
  8. Click on the "Save" button to save the changes.

By following the above steps, you have successfully enabled the Firewall Change Log Alerts for the selected project in GCP. This will help you to track any changes made to the firewall rules and take necessary actions in case of any unauthorized changes.

Using CLI

To remediate the misconfiguration "Firewall Change Log Alerts Should Be Enabled" for GCP using GCP CLI, follow these steps:

  1. Open the Cloud Shell in the GCP Console.
  2. Run the following command to enable firewall log exports:
gcloud logging sinks create firewall_logs_sink storage.googleapis.com/[BUCKET_NAME] --log-filter="resource.type=gce_firewall_rule AND protoPayload.methodName=compute.firewalls.patch AND protoPayload.serviceData.rule.direction=INGRESS" --include-children --organization=[ORGANIZATION_ID] --project=[PROJECT_ID]

Replace [BUCKET_NAME] with the name of the GCS bucket where you want to store the logs, [ORGANIZATION_ID] with the ID of your GCP organization, and [PROJECT_ID] with the ID of the GCP project where you want to enable the firewall log exports.

  1. Run the following command to grant the Logs Writer role to the cloud-logs@google.com service account:
gcloud projects add-iam-policy-binding [PROJECT_ID] --member="serviceAccount:cloud-logs@google.com" --role="roles/logging.logWriter"

Replace [PROJECT_ID] with the ID of the GCP project where you enabled the firewall log exports.

  1. Run the following command to create a firewall rule to allow traffic from the cloud-logs@google.com service account:
gcloud compute firewall-rules create allow-cloud-logs --direction=INGRESS --priority=1000 --network=default --action=ALLOW --rules=tcp:22 --source-service-account=cloud-logs@google.com --target-tags=allow-cloud-logs
  1. Run the following command to add the allow-cloud-logs tag to the instances where you want to allow traffic from the cloud-logs@google.com service account:
gcloud compute instances add-tags [INSTANCE_NAME] --tags=allow-cloud-logs --zone=[ZONE]

Replace [INSTANCE_NAME] with the name of the instance where you want to allow traffic from the cloud-logs@google.com service account, and [ZONE] with the zone where the instance is located.

By following these steps, you will enable firewall log exports and allow the cloud-logs@google.com service account to access the logs.

Using Python

To remediate the misconfiguration "Firewall Change Log Alerts Should Be Enabled" in GCP using Python, you can follow the below steps:

Step 1: Install the necessary libraries

pip install google-cloud-logging google-auth

Step 2: Authenticate with GCP

from google.oauth2 import service_account
from google.cloud import logging_v2

credentials = service_account.Credentials.from_service_account_file(
    '/path/to/your/credentials.json')
client = logging_v2.LoggingServiceV2Client(credentials=credentials)

Step 3: Create a log sink

from google.cloud.logging_v2.types import LogSink

sink_name = "firewall-change-log-alerts"
destination_uri = "pubsub://projects/{project_id}/topics/{topic_name}"
filter_ = "logName=projects/{project_id}/logs/compute.googleapis.com%2Ffirewall"
sink = LogSink(
    name=sink_name,
    destination=destination_uri,
    filter=filter_,
    include_children=True
)
parent = f"projects/{project_id}"
client.create_sink(parent=parent, sink=sink)

Step 4: Verify the log sink

sinks = client.list_sinks(parent=f"projects/{project_id}")
for sink in sinks:
    if sink.name == sink_name:
        print("Log sink created successfully")
        break
else:
    print("Log sink creation failed")

After running these steps, the log sink for Firewall Change Log Alerts will be created successfully in GCP using Python.

Using Terraform
resource "google_logging_metric" "firewall_change_metric" {
  project = "YOUR_GCP_PROJECT_ID" # replace with your project ID
  name    = "firewall_change_events"
  description = "Logs-based metric counting GCE firewall rule changes (insert, patch, delete)."

  filter = <<-EOT
    resource.type="gce_firewall_rule"
    protoPayload.methodName=(
      "v1.compute.firewalls.insert" OR
      "v1.compute.firewalls.patch" OR
      "v1.compute.firewalls.delete"
    )
  EOT

  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
    unit        = "1"
  }

  label_extractors = {
    "log_id" = "EXTRACT(jsonPayload.@type)" # optional – adjust or remove as needed
  }
}

resource "google_monitoring_alert_policy" "firewall_change_alert" {
  project      = "YOUR_GCP_PROJECT_ID" # replace with your project ID
  display_name = "Firewall Change Log Alert"

  combiner = "OR"

  conditions {
    display_name = "Firewall change metric exceeds threshold"

    condition_threshold {
      filter = "metric.type = \"logging.googleapis.com/user/${google_logging_metric.firewall_change_metric.name}\""

      # Alert if there is at least 1 firewall change in a 5‑minute window.
      # If you have a specific threshold, replace 1 with that value.
      comparison      = "COMPARISON_GT"
      threshold_value = 0
      duration        = "0s"

      aggregations {
        alignment_period   = "300s"
        per_series_aligner = "ALIGN_DELTA"
        cross_series_reducer = "REDUCE_SUM"
        group_by_fields      = []
      }

      trigger {
        count = 1
      }
    }
  }

  notification_channels = [
    "projects/YOUR_GCP_PROJECT_ID/notificationChannels/YOUR_NOTIFICATION_CHANNEL_ID"
  ] # replace with your existing notification channel(s)

  user_labels = {
    environment = "YOUR_ENV_LABEL" # optional – replace or remove
  }
}

terraform plan should show creation of one google_logging_metric.firewall_change_metric and one google_monitoring_alert_policy.firewall_change_alert, with no destructive changes to existing resources.