> ## Documentation Index > Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt > Use this file to discover all available pages before exploring further. # Cloud Monitoring Should Monitor Storage Authentication Counts ### More Info: Ensure Cloud Monitoring monitors storage authentication counts. ### Risk Level Medium ### Address Security ### Compliance Standards * APRA CPS 234 (Australia) * BSI C5 (Germany) * Brazil LGPD * CCPA / CPRA (California) * CIS Critical Security Controls v8 * CMMC 2.0 * CSA Cloud Controls Matrix v4 * Cloudanix Best Practice * DPDPA * Digital Operational Resilience Act (EU) * Essential 8 * ISO/IEC 27017 * ISO/IEC 27018 * ISO/IEC 27701 * KSA PDPL * MAS Technology Risk Management (Singapore) * MITRE ATT\&CK (Cloud) * NIS2 Directive * NIST SP 800-171 * NYDFS 23 NYCRR 500 * SWIFT Customer Security Controls Framework * Sarbanes-Oxley IT General Controls * UK NCSC Cyber Assessment Framework ### Triage and Remediation ### Remediation To remediate the misconfiguration "Cloud Monitoring Should Monitor Storage Authentication Counts" for GCP using GCP console, you can follow the below steps: 1. Open the Google Cloud Console and navigate to the Cloud Storage page. 2. Select the bucket that you want to monitor and click on the "Edit bucket details" button. 3. In the "Edit bucket details" page, scroll down to the "Access control" section. 4. Under the "Access control" section, you will see a list of all the users and groups that have access to the bucket. 5. Click on the "Add members" button to add new members to the bucket. 6. In the "Add members" dialog box, enter the email address of the user or group that you want to add to the bucket. 7. Select the appropriate role for the user or group from the dropdown menu. For example, you can select "Storage Object Viewer" or "Storage Object Creator" depending on the level of access you want to grant. 8. Click on the "Add" button to add the user or group to the bucket. 9. Repeat steps 6-8 for all the users and groups that need access to the bucket. 10. Once you have added all the necessary users and groups, click on the "Save" button to save the changes. By following the above steps, you will be able to remediate the misconfiguration "Cloud Monitoring Should Monitor Storage Authentication Counts" for GCP using GCP console. # To remediate the misconfiguration "Cloud Monitoring Should Monitor Storage Authentication Counts" for GCP using GCP CLI, follow the below steps: 1. Open the Cloud Shell in GCP Console. 2. Run the following command to enable the Cloud Storage API: ``` gcloud services enable storage-api.googleapis.com ``` 3. Run the following command to create a Pub/Sub topic to store the audit logs: ``` gcloud pubsub topics create [TOPIC_NAME] ``` 4. Run the following command to grant the Cloud Storage service account permission to publish messages to the Pub/Sub topic: ``` gcloud projects add-iam-policy-binding [PROJECT_ID] --member="serviceAccount:[SERVICE_ACCOUNT_EMAIL]" --role="roles/pubsub.publisher" ``` Note: Replace \[TOPIC\_NAME], \[PROJECT\_ID], and \[SERVICE\_ACCOUNT\_EMAIL] with the appropriate values. 5. Run the following command to create a sink to export Cloud Storage audit logs to the Pub/Sub topic: ``` gcloud logging sinks create [SINK_NAME] pubsub.googleapis.com/projects/[PROJECT_ID]/topics/[TOPIC_NAME] --log-filter='resource.type="gcs_bucket" AND protoPayload.methodName="storage.objects.create" AND protoPayload.authenticationInfo.principalEmail!="service-[PROJECT_NUMBER]@gcp-sa-logging.iam.gserviceaccount.com"' ``` Note: Replace \[SINK\_NAME], \[PROJECT\_ID], and \[TOPIC\_NAME] with the appropriate values. 6. Run the following command to update the Cloud Storage bucket to export audit logs to the sink: ``` gsutil logging set on -b gs://[BUCKET_NAME] -o [SINK_NAME] ``` Note: Replace \[BUCKET\_NAME] and \[SINK\_NAME] with the appropriate values. 7. Verify that the sink is exporting audit logs to the Pub/Sub topic by checking the topic subscription: ``` gcloud pubsub subscriptions describe projects/[PROJECT_ID]/subscriptions/[SUBSCRIPTION_NAME] ``` Note: Replace \[PROJECT\_ID] and \[SUBSCRIPTION\_NAME] with the appropriate values. By following the above steps, you can remediate the misconfiguration "Cloud Monitoring Should Monitor Storage Authentication Counts" for GCP using GCP CLI. To remediate the issue of monitoring storage authentication counts in GCP using Python, follow these steps: 1. Install the required libraries: Use the following command to install the required libraries: ```python theme={null} !pip install google-cloud-storage ``` 2. Set up authentication: Use the following code to authenticate your GCP account: ```python theme={null} from google.oauth2 import service_account credentials = service_account.Credentials.from_service_account_file('path/to/your/credentials.json') ``` 3. Create a Storage client: Use the following code to create a Storage client: ```python theme={null} from google.cloud import storage storage_client = storage.Client(credentials=credentials) ``` 4. Get the bucket: Use the following code to get the bucket: ```python theme={null} bucket = storage_client.get_bucket('your-bucket-name') ``` 5. Get the IAM policy: Use the following code to get the IAM policy: ```python theme={null} policy = bucket.get_iam_policy(requested_policy_version=3) ``` 6. Update the IAM policy: Use the following code to update the IAM policy: ```python theme={null} from google.cloud.storage import BucketIAMMember from google.cloud.storage import StoragePermissions policy.bindings.append(BucketIAMMember('allUsers', 'roles/storage.objectViewer')) policy.bindings.append(BucketIAMMember('allAuthenticatedUsers', 'roles/storage.objectViewer')) policy.bindings.append(BucketIAMMember('allUsers', 'roles/storage.objectCreator')) policy.bindings.append(BucketIAMMember('allAuthenticatedUsers', 'roles/storage.objectCreator')) policy.version += 1 bucket.set_iam_policy(policy) ``` 7. Verify the IAM policy: Use the following code to verify the IAM policy: ```python theme={null} policy = bucket.get_iam_policy(requested_policy_version=3) print(policy) ``` These steps will remediate the issue of monitoring storage authentication counts in GCP using Python. ```hcl theme={null} resource "google_monitoring_alert_policy" "storage_authentication_counts" { project = "GCP_PROJECT_ID" # Replace with your project ID display_name = "Monitor Storage Authentication Counts" combiner = "OR" conditions { display_name = "GCS authentication count high" condition_threshold { filter = "metric.type=\"storage.googleapis.com/authentication/authentication_count\" AND resource.type=\"gcs_bucket\"" comparison = "COMPARISON_GT" threshold_value = THRESHOLD_VALUE # Replace with numeric threshold (e.g., 1000) duration = "900s" # Replace if a different evaluation window is required trigger { count = 1 } aggregations { alignment_period = "300s" per_series_aligner = "ALIGN_RATE" cross_series_reducer = "REDUCE_SUM" group_by_fields = ["resource.label.bucket_name"] } } } notification_channels = [ "projects/GCP_PROJECT_ID/notificationChannels/NOTIFICATION_CHANNEL_ID" ] # Replace with real notification channel(s) user_labels = { environment = "ENVIRONMENT_LABEL" # Optional: e.g. "prod" } } ``` This change does not force replacement of any existing GCS buckets; it only creates/updates a Cloud Monitoring alert policy. To verify, `terraform plan` should show this `google_monitoring_alert_policy.storage_authentication_counts` being created (or its condition updated) with the `metric.type="storage.googleapis.com/authentication/authentication_count"` filter and your chosen `threshold_value`. ### Additional Reading: * [https://cloud.google.com/monitoring/api/metrics\_gcp](https://cloud.google.com/monitoring/api/metrics_gcp)