Load Balancer Global Backend Services Should Have Logging Enabled
More Info:
Load balancers global backend services should have request logging enabled. Logging requests to Load Balancer endpoints is a helpful way of detecting and investigating potential attacks.Risk Level
MediumAddress
Security, Operational MaturityCompliance Standards
SOC2, GDPR, HITRUST, NISTCSF, PCIDSS, FedRAMPTriage and Remediation
Remediation
Using Console
Using Console
To remediate the misconfiguration of Load Balancer Global Backend Services not having logging enabled in GCP, you can follow the below steps using the GCP console:
- Open the GCP console and navigate to the Load balancing section.
- Select the Load Balancer for which you want to enable logging.
- Click on the Edit button on the top of the Load Balancer details page.
- Scroll down to the Backend configuration section and click on the pencil icon next to the Global backend configuration.
- In the Global backend configuration settings, scroll down to the Logging section and click on the toggle button to enable logging.
- Select the appropriate log type from the drop-down menu.
- Click on the Save button to save the changes.
Using CLI
Using CLI
To remediate the Load Balancer Global Backend Services should have logging enabled in GCP, you can follow the below steps using GCP CLI:
- Open the Cloud Shell in the GCP Console.
-
Run the following command to enable logging for the backend service:
Replace
[BACKEND_SERVICE_NAME]with the name of the backend service for which you want to enable logging. - Once the command is executed successfully, the logging will be enabled for the backend service.
-
You can verify the logging is enabled by running the following command:
This command should return the value
loggingEnabled: true.
Using Python
Using Python
To remediate the misconfiguration of Load Balancer Global Backend Services not having logging enabled in GCP using Python, follow the steps below:
- Import the necessary libraries:
- Set up the credentials using the service account key file:
- Create a service object for the Compute Engine API:
- Get the project ID:
- Get the list of all the backend services:
- Loop through the backend services and enable logging for each one:
- Run the script and verify that logging has been enabled for all the backend services.