Audit configuration logging remediation

Using Console

To remediate Audit Configuration Logging for GCP IAM using the GCP Console, you need to ensure that Cloud Audit Logs (especially Admin Activity and appropriate Data Access logs) are enabled for IAM and that logs are being exported/retained as needed.

1. Verify IAM Audit Logs Are Enabled

Go to Google Cloud Console:
https://console.cloud.google.com
Select the project (or folder/organization) you want to remediate from the top project selector.
In the left menu, go to:
IAM & Admin → Audit Logs
At the top, select the scope:
- If you have access, switch to Organization or Folder level using the scope selector.
- Otherwise, do it at the project level.
In the “Audit logs” page:
- In the Service list, find and select:
  - IAM Service Account Credentials API
  - Cloud Identity and Access Management (iam.googleapis.com)
    (names may vary slightly, but look for IAM-related services)
- Or simply click All services if your policy requires global coverage.
For each relevant service, ensure:
- Admin Read: Enabled (checkbox checked)
- Admin Write: Enabled
- Data Read: Enable if your policy requires data access logging
- Data Write: Enable if your policy requires data access logging
Click Save at the bottom.

Note:

Admin Activity logs are on by default and can’t be disabled, but explicitly enabling the checkboxes ensures consistent configuration and visibility in the UI.

Data Access logs (Data Read/Write) may incur additional cost; enable them to match your compliance requirements.

2. Confirm Logs Are Being Written

Go to Logging → Logs Explorer in the left menu.
Ensure the correct project is selected at the top.
In the query builder, run a basic query to view IAM audit logs, for example:
- Click “Query builder → Resource”, select a resource type like:
  - IAM Service Account, or
  - Project
- Then in the Log name filter, choose:
  - cloudaudit.googleapis.com/activity
  - and/or cloudaudit.googleapis.com/data
Click Run query and verify that IAM-related admin and data access events are appearing.

3. (Optional) Configure Log Retention or Export

If your audit requirement includes long-term retention or external SIEM:

Go to Logging → Log Router.
Click Create Sink:
- Give it a name (e.g., iam-audit-logs-sink).
- In the Sink destination, choose:
  - Cloud Storage (for archive), or
  - BigQuery (for analytics), or
  - Pub/Sub (for SIEM forwarding).

In the Build inclusion filter, restrict to IAM audit logs, for example:

logName:"cloudaudit.googleapis.com" AND
protoPayload.serviceName="iam.googleapis.com"

Complete sink creation, granting the sink’s service account the required write permissions on the destination.

4. (Optional) Enforce via Organization Policy

To prevent disabling audit logs:

Go to IAM & Admin → Organization policies.
Search for policies related to:
- constraints/logging.adminActivityService
- constraints/logging.dataAccessService
Edit and set them to enforce required logging for IAM services.

This sequence ensures IAM configuration changes and access are fully logged and retained according to compliance requirements using only the GCP Console.

Using CLI

Below are the steps to remediate “Audit Configuration Logging” issues for GCP IAM by enabling Audit Logs using the gcloud CLI. I’ll show it at the project level; you can adapt for folders/organization.

1. Set your target project

gcloud config set project PROJECT_ID

Replace PROJECT_ID with your project ID.

2. Export current IAM policy to a file

gcloud projects get-iam-policy PROJECT_ID \
  --format=json > iam-policy.json

This creates iam-policy.json that you’ll edit to add auditConfigs.

3. Edit the IAM policy to add audit logging

Open iam-policy.json in an editor and add or update the auditConfigs section.

Example: Enable all audit log types for all services

Add this top-level block (sibling to "bindings"):

{
  "bindings": [
    ... existing bindings here ...
  ],
  "auditConfigs": [
    {
      "service": "allServices",
      "auditLogConfigs": [
        {
          "logType": "ADMIN_READ"
        },
        {
          "logType": "DATA_READ"
        },
        {
          "logType": "DATA_WRITE"
        }
      ]
    }
  ]
}

Notes:

service: "allServices" enables audit logging for every supported Google Cloud service.
logTypes:
- ADMIN_READ – read operations on configuration/resources.
- DATA_READ – read access to user data.
- DATA_WRITE – write access to user data.

If you need to exempt service accounts from specific logs, add:

{
  "logType": "DATA_READ",
  "exemptedMembers": [
    "user:alice@example.com",
    "serviceAccount:sa-name@PROJECT_ID.iam.gserviceaccount.com"
  ]
}

Keep the rest of the file unchanged.

4. Re-apply the updated IAM policy

gcloud projects set-iam-policy PROJECT_ID iam-policy.json

Confirm that the command succeeds and doesn’t report invalid JSON or fields.

5. Verify the audit configuration

gcloud projects get-iam-policy PROJECT_ID \
  --format=json | jq '.auditConfigs'

You should see the allServices audit configuration with ADMIN_READ, DATA_READ, and DATA_WRITE.

6. (Optional) Do the same at org/folder level

Organization:

ORG_ID=123456789012

gcloud organizations get-iam-policy $ORG_ID --format=json > org-iam.json
# Edit org-iam.json to add the same `auditConfigs` block
gcloud organizations set-iam-policy $ORG_ID org-iam.json

Folder:

FOLDER_ID=345678901234

gcloud resource-manager folders get-iam-policy $FOLDER_ID --format=json > folder-iam.json
# Edit folder-iam.json to add `auditConfigs`
gcloud resource-manager folders set-iam-policy $FOLDER_ID folder-iam.json

These steps remediate audit configuration logging issues by ensuring IAM audit logs (Admin & Data) are enabled via the GCP CLI.

Using Python

Below are step‑by‑step instructions and a Python example to remediate missing Audit Configuration Logging for GCP IAM (i.e., enable Data Access audit logs via IAM auditConfigs).

1. Decide the Scope and Services

First decide:

Scope: organization, folder, or project
- Org: organizations/1234567890
- Folder: folders/34567890
- Project: projects/my-project-id or projects/1234567890
Services to log:
- "allServices" (recommended) or specific services like "iam.googleapis.com"
Log types:
- "ADMIN_READ", "DATA_READ", "DATA_WRITE"
  (Admin Activity logs are always on and free; Data Access logs can generate cost.)

Example choice (recommended baseline):

Scope: projects/my-project-id
Service: allServices
Log types: DATA_READ, DATA_WRITE

2. Enable Required APIs

Make sure the following APIs are enabled on the project you use to run the script:

Cloud Resource Manager API (cloudresourcemanager.googleapis.com)
IAM API (iam.googleapis.com) – not strictly necessary to update auditConfigs, but often used in tandem

gcloud services enable cloudresourcemanager.googleapis.com iam.googleapis.com \
  --project=YOUR-BILLING-PROJECT-ID

3. Set Up Authentication

Use a service account with Owner or at least:

resourcemanager.organizations.setIamPolicy or
resourcemanager.projects.setIamPolicy / resourcemanager.folders.setIamPolicy

Authenticate locally:

gcloud auth application-default login

Your Python code will then pick up the ADC (Application Default Credentials).

4. Python Code: Enable Audit Config Logging

This example:

Reads the current IAM policy at the scope.
Merges/updates the auditConfigs for allServices.
Ensures both DATA_READ and DATA_WRITE are enabled.
Writes the policy back.

from googleapiclient import discovery
from google.oauth2 import service_account
import google.auth

# -------------------------------------------------------------------
# 1. CONFIGURE YOUR TARGET RESOURCE
# -------------------------------------------------------------------
# Examples:
# resource = "organizations/1234567890"
# resource = "folders/34567890"
resource = "projects/my-project-id"

# Service to configure: "allServices" or specific service(s), e.g. "iam.googleapis.com"
TARGET_SERVICE = "allServices"
LOG_TYPES_TO_ENABLE = ["DATA_READ", "DATA_WRITE"]   # Add "ADMIN_READ" if needed

# -------------------------------------------------------------------
# 2. BUILD THE CLOUD RESOURCE MANAGER CLIENT
# -------------------------------------------------------------------
# If you have a service account JSON file:
# credentials = service_account.Credentials.from_service_account_file("key.json")
# crm = discovery.build("cloudresourcemanager", "v1", credentials=credentials)
credentials, _ = google.auth.default(scopes=["https://www.googleapis.com/auth/cloud-platform"])
crm = discovery.build("cloudresourcemanager", "v1", credentials=credentials)

# -------------------------------------------------------------------
# 3. HELPER: MERGE/UPDATE AUDIT CONFIGS
# -------------------------------------------------------------------
def merge_audit_configs(existing_audit_configs, target_service, log_types):
    """
    Ensure that 'target_service' has all 'log_types' enabled in auditConfigs.
    Returns the updated auditConfigs list.
    """
    if existing_audit_configs is None:
        existing_audit_configs = []

    # Find existing config for the service
    service_config = None
    for ac in existing_audit_configs:
        if ac.get("service") == target_service:
            service_config = ac
            break

    if not service_config:
        service_config = {"service": target_service, "auditLogConfigs": []}
        existing_audit_configs.append(service_config)

    # Build a mapping of logType -> auditLogConfig
    existing_log_types = {c["logType"]: c for c in service_config.get("auditLogConfigs", [])}

    for lt in log_types:
        if lt not in existing_log_types:
            service_config.setdefault("auditLogConfigs", []).append({"logType": lt})

    return existing_audit_configs

# -------------------------------------------------------------------
# 4. GET CURRENT IAM POLICY
# -------------------------------------------------------------------
get_req = crm.projects().getIamPolicy(  # change to organizations().getIamPolicy or folders() if needed
    resource=resource,
    body={"options": {"requestedPolicyVersion": 3}}
)
policy = get_req.execute()

# -------------------------------------------------------------------
# 5. UPDATE AUDIT CONFIGS
# -------------------------------------------------------------------
audit_configs = policy.get("auditConfigs")
audit_configs = merge_audit_configs(audit_configs, TARGET_SERVICE, LOG_TYPES_TO_ENABLE)
policy["auditConfigs"] = audit_configs

# -------------------------------------------------------------------
# 6. WRITE BACK THE UPDATED POLICY
# -------------------------------------------------------------------
set_req = crm.projects().setIamPolicy(  # change to organizations().setIamPolicy or folders() if needed
    resource=resource,
    body={"policy": policy}
)
updated_policy = set_req.execute()

print("Updated IAM policy auditConfigs for:", resource)
for ac in updated_policy.get("auditConfigs", []):
    print(ac)

Adjusting for Organization or Folder

Change the client calls:

For organization:

get_req = crm.organizations().getIamPolicy(
    resource="organizations/1234567890",
    body={"options": {"requestedPolicyVersion": 3}}
)
set_req = crm.organizations().setIamPolicy(
    resource="organizations/1234567890",
    body={"policy": policy}
)

For folder:

get_req = crm.folders().getIamPolicy(
    resource="folders/34567890",
    body={"options": {"requestedPolicyVersion": 3}}
)
set_req = crm.folders().setIamPolicy(
    resource="folders/34567890",
    body={"policy": policy}
)

5. Verify in Cloud Console

Go to IAM & Admin → Audit Logs.
Select the project / folder / organization.
Confirm:
- Service: All services (or the one you configured).
- Log Types: Data Read and Data Write are enabled.

If you tell me your exact scope (project/org) and whether you want all services or specific ones (like just IAM), I can tailor the code snippet precisely to that.

Using Terraform

resource "google_logging_metric" "audit_config_change" {
  # Logs-based metric for detecting audit configuration changes
  name   = "audit_config_change_count"
  project = "PROJECT_ID" # replace with your GCP project ID

  description = "Count of audit configuration changes (SetIamPolicy with auditConfigDeltas)"

  filter = <<-EOT
    resource.type="project"
    protoPayload.methodName="SetIamPolicy"
    protoPayload.serviceData.policyDelta.auditConfigDeltas:*
  EOT

  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
  }

  label_extractors = {
    "resource" = "EXTRACT(protoPayload.resourceName)"
  }
}

resource "google_monitoring_alert_policy" "audit_config_change_alert" {
  project      = "PROJECT_ID" # replace with your GCP project ID
  display_name = "Audit Configuration Change Alert"

  combiner = "OR"

  conditions {
    display_name = "Audit config change metric > 0"

    condition_threshold {
      filter = "metric.type=\"logging.googleapis.com/user/${google_logging_metric.audit_config_change.name}\""

      comparison      = "COMPARISON_GT"
      threshold_value = 0
      duration        = "0s"

      aggregations {
        alignment_period     = "60s"
        per_series_aligner   = "ALIGN_DELTA"
        cross_series_reducer = "REDUCE_SUM"
        group_by_fields      = ["metric.label.resource"]
      }
    }
  }

  notification_channels = [
    "NOTIFICATION_CHANNEL_RESOURCE_ID" # replace with google_monitoring_notification_channel.ID
  ]

  enabled = true
}

This adds a new logs-based metric and alert policy; it does not force replacement of existing metrics unless you change an existing metric’s name.Verification: terraform plan should show + create for google_logging_metric.audit_config_change and google_monitoring_alert_policy.audit_config_change_alert with no unexpected changes to other resources.

GCP Introduction

GCP Pricing

GCP Threats

GCP Misconfigurations

Resources

GCP Threats

Audit configuration logging remediation

Triage and Remediation

Remediation

1. Verify IAM Audit Logs Are Enabled

2. Confirm Logs Are Being Written

3. (Optional) Configure Log Retention or Export

4. (Optional) Enforce via Organization Policy

1. Set your target project

2. Export current IAM policy to a file

3. Edit the IAM policy to add audit logging

Example: Enable all audit log types for all services

4. Re-apply the updated IAM policy

5. Verify the audit configuration

6. (Optional) Do the same at org/folder level

1. Decide the Scope and Services

2. Enable Required APIs

3. Set Up Authentication

4. Python Code: Enable Audit Config Logging

Adjusting for Organization or Folder

5. Verify in Cloud Console

​Triage and Remediation

​Remediation

​1. Verify IAM Audit Logs Are Enabled

​2. Confirm Logs Are Being Written

​3. (Optional) Configure Log Retention or Export

​4. (Optional) Enforce via Organization Policy

​1. Set your target project

​2. Export current IAM policy to a file

​3. Edit the IAM policy to add audit logging

​Example: Enable all audit log types for all services

​4. Re-apply the updated IAM policy

​5. Verify the audit configuration

​6. (Optional) Do the same at org/folder level

​1. Decide the Scope and Services

​2. Enable Required APIs

​3. Set Up Authentication

​4. Python Code: Enable Audit Config Logging

​Adjusting for Organization or Folder

​5. Verify in Cloud Console

Triage and Remediation

Remediation

1. Verify IAM Audit Logs Are Enabled

2. Confirm Logs Are Being Written

3. (Optional) Configure Log Retention or Export

4. (Optional) Enforce via Organization Policy

1. Set your target project

2. Export current IAM policy to a file

3. Edit the IAM policy to add audit logging

Example: Enable all audit log types for all services

4. Re-apply the updated IAM policy

5. Verify the audit configuration

6. (Optional) Do the same at org/folder level

1. Decide the Scope and Services

2. Enable Required APIs

3. Set Up Authentication

4. Python Code: Enable Audit Config Logging

Adjusting for Organization or Folder

5. Verify in Cloud Console