Bigtable Tables Should Have Audit Logging Enabled
More Info:
DATA_READ, DATA_WRITE and ADMIN_READ logs should be enabled on Cloud Bigtable tablesRisk Level
MediumAddress
Operational Maturity, SecurityCompliance Standards
HITRUSTTriage and Remediation
Remediation
Using Console
Using Console
To remediate “Bigtable Tables Should Have Audit Logging Enabled” for GCP using GCP console, follow these steps:
- Open the GCP Console and navigate to the Bigtable instance for which you want to enable audit logging.
- Click on the “Edit” button on the top of the page.
- In the “Edit instance” page, scroll down to the “Cloud audit logs” section and click on the “Add logging” button.
- In the “Add logging” dialog box, select the “All Cloud Audit Logs” option and click on the “Save” button.
- Once you have enabled audit logging for the Bigtable instance, you can view the logs in the Cloud Logging console.
Using CLI
Using CLI
To remediate the misconfiguration of Bigtable Tables not having Audit Logging enabled in GCP using GCP CLI, follow the below steps:
- Open the Cloud Shell in your GCP console.
-
Run the following command to enable audit logging for Bigtable Tables:
Replace
<instance-id>and<table-id>with your specific instance and table IDs respectively. - This command will set an IAM policy for the specified Bigtable table and enable audit logging for the “DATA_READ” log type.
-
Verify that audit logging is enabled for the Bigtable table by running the following command:
This command will display the audit logging configurations for the specified table.
Using Python
Using Python
To remediate the misconfiguration “Bigtable Tables Should Have Audit Logging Enabled” for GCP using Python, follow the below steps:Step 1: Import the necessary libraries and authenticate the user using the below code:Step 2: List all the Bigtable instances in the project using the below code:Step 3: Select the instance for which you want to enable audit logging and list all the tables in that instance using the below code:Step 4: Enable audit logging for all the tables in the selected instance using the below code:Note: Replace ‘instance-id’ with the actual ID of the instance for which you want to enable audit logging and replace ‘user:[email protected]’ with the email address of the user for whom you want to enable audit logging.Step 5: Verify that audit logging is enabled for all the tables in the selected instance using the below code:This will print the IAM policy for each table, which should include the auditConfigs section with the logType and service specified.By following the above steps, you can remediate the misconfiguration “Bigtable Tables Should Have Audit Logging Enabled” for GCP using Python.