GCP DNS Should Have Logging Enabled
More Info:
Ensure that Cloud DNS has logging enabled.Risk Level
LowAddress
Operational Maturity, Reliability, SecurityCompliance Standards
CISGCP, CBPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of GCP DNS not having logging enabled, you can follow the below steps using the GCP console:
- Open the GCP console and navigate to the Cloud DNS page.
- Select the DNS zone that needs to have logging enabled.
- Click on the “Edit” button at the top of the page.
- In the “Logging” section, select the checkbox for “Log DNS queries”.
- Choose the destination for the logs. You can either select “Logs Explorer” or “Cloud Storage”.
- If you choose “Cloud Storage”, provide the bucket name and folder path where the logs will be stored.
- Click on the “Save” button to save the changes.
Using CLI
Using CLI
To remediate the misconfiguration of GCP DNS not having logging enabled, follow the below steps:
- Open the Google Cloud Console and select the project that needs to be remediated.
- Click on the Navigation menu and select “Logging” under the “Operations” section.
- Click on the “Log Exports” tab and then click on the “Create Export” button.
- In the “Create Export” window, select “Cloud Storage” as the sink destination.
- Select the Cloud Storage bucket where you want to store the logs.
- In the “Filter” section, select “Advanced Filter” and enter the following filter:
- Click on the “Create” button to create the export.
- Now, go to the Cloud DNS page in the Google Cloud Console.
- Click on the name of the DNS zone that needs to be remediated.
- Click on the “Edit” button at the top of the page.
- In the “Logging” section, select the “Export to Cloud Logging” checkbox.
- Select the log export that was created in step 7 from the dropdown list.
- Click on the “Save” button to save the changes.
Using Python
Using Python
To remediate this misconfiguration, you can use the following steps in Python:These steps will enable logging for DNS in GCP. You can modify the filter to include other log types as well.
- Import the required libraries:
- Set up the client for the GCP project:
- Define the log metric:
- Create the log metric:
- Verify that the log metric has been created: