GCP Introduction
GCP Pricing
GCP Threats
GCP Misconfigurations
- Getting Started with GCP Audit
- CloudSql Audit
- Cloud Tasks Monitoring
- Dataflow Monitoring
- Function Monitoring
- Monitoring Compliance
- PubSubLite Monitoring
- Spanner Monitoring
- NoSQL Monitoring
- Compute Audit
- IAM Audit
- BigQuery Monitoring
- CDN Monitoring
- DNS Monitoring
- KMS Monitoring
- Kubernetes Audit
- Load Balancer Monitoring
- Log Monitoring
- Storage Audit
- Pub/Sub Monitoring
- VPC Audit
- IAM Deep Dive
GCP Threats
Audit Configuration Change Log Alerts Should Be Enabled
More Info:
Ensures that logging and log alerts exist for audit configuration changes. Project Ownership is the highest level of privilege on a project, any changes in audit configuration should be heavily monitored to prevent unauthorized changes.
Risk Level
Medium
Address
Security
Compliance Standards
SOC2, CISGCP, CBP, HITRUST, GDPR, PCIDSS
Triage and Remediation
Remediation
To remediate the misconfiguration “Audit Configuration Change Log Alerts Should Be Enabled” on GCP using the GCP console, you can follow these steps:
-
Open the GCP console and navigate to the Cloud Logging page.
-
Click on “Logs-based Metrics” in the left-hand menu.
-
Click on “Create Metric” to create a new metric.
-
Give your metric a name and description, and set the filter to the following:
resource.type="project" protoPayload.methodName="SetIamPolicy"This filter will match any changes to the IAM policy for your project.
-
Under “Configuration”, select “Create Alert from Metric”.
-
Configure your alert as desired, including the notification channels you want to use.
-
Save your alert.
By following these steps, you will have enabled Audit Configuration Change Log Alerts on GCP, allowing you to be notified whenever changes are made to your project’s IAM policy.
To remediate the misconfiguration “Audit Configuration Change Log Alerts Should Be Enabled” for GCP using GCP CLI, please follow the below steps:
- Open the GCP Cloud console and navigate to the Security Command Center.
- Click on the “Security Health Analytics” tab and select “Audit Configuration Change Log Alerts” from the list of security checks.
- If the check is failed, click on the “Remediate” button.
- In the “Remediation” dialog box, select the “GCP CLI” option.
- Open the Cloud Shell in the GCP console.
- Run the following command to enable the audit configuration change log alerts:
gcloud logging sinks create [SINK_NAME] storage.googleapis.com/[BUCKET_NAME] --log-filter='resource.type="audited_resource" AND protoPayload.methodName="google.cloud.audit.AuditLogService.UpdateConfig"'
Note: Replace [SINK_NAME] with a name for the sink and [BUCKET_NAME] with the name of the destination bucket.
- After running the above command, verify that the audit configuration change log alerts are enabled by running the following command:
gcloud logging sinks describe [SINK_NAME]
- Check the output of the above command to ensure that the “logFilter” parameter is set to
resource.type="audited_resource" AND protoPayload.methodName="google.cloud.audit.AuditLogService.UpdateConfig".
Once the above steps are completed, the misconfiguration “Audit Configuration Change Log Alerts Should Be Enabled” for GCP using GCP CLI will be remediated.
To remediate the misconfiguration “Audit Configuration Change Log Alerts Should Be Enabled” for GCP using Python, you can follow these steps:
- Install the Google Cloud SDK and authenticate with your GCP account using the following command:
gcloud auth login
- Install the required Python libraries using the following command:
pip install google-cloud-logging google-auth google-auth-oauthlib google-auth-httplib2
- Create a new Python script and import the required libraries:
from google.cloud import logging_v2
from google.oauth2 import service_account
-
Create a service account with the necessary permissions to access the logs using the GCP Console.
-
Create a credentials object using the service account key file:
credentials = service_account.Credentials.from_service_account_file('path/to/keyfile.json')
- Create a Logging client object:
client = logging_v2.LoggingServiceV2Client(credentials=credentials)
- Retrieve the current configuration for the project’s logging sink:
project_id = 'your-project-id'
sink_name = 'sink-name'
sink = client.get_sink(f"projects/{project_id}/sinks/{sink_name}")
- Modify the configuration to enable audit configuration change log alerts:
sink.filter = 'logName:cloudaudit.googleapis.com%2Factivity AND protoPayload.methodName:google.cloud.resourcemanager.v1.Projects.Update'
sink.output_version_format = 'V2'
sink.writer_identity = 'serviceAccount:[email protected]'
sink.include_children = True
sink.create_time = None
sink.update_time = None
response = client.update_sink(sink_name, sink, unique_writer_identity=True)
- Verify that the configuration has been updated by checking the sink’s properties:
print(response)
This should remediate the misconfiguration “Audit Configuration Change Log Alerts Should Be Enabled” for GCP using Python.