​
More Info:

Ensure that GCP Cloud Monitoring notification channel is enabled.

​
Risk Level

Medium

​
Address

Operational Maturity, Security

​
Compliance Standards

CBP

​
Triage and Remediation

​
Remediation

Using Console

To remediate the misconfiguration “Cloud Monitoring Notification Channel Should Be Enabled” for GCP using GCP console, follow these steps:
  1. Go to the GCP Console and select the project where the misconfiguration is present.
  2. Click on the “Navigation menu” icon (three horizontal lines) in the top-left corner of the console and select “Monitoring”.
  3. In the Monitoring dashboard, click on the “Notification channels” tab on the left-hand side.
  4. Click on the “Add notification channel” button at the top of the page.
  5. Select the appropriate notification channel type (e.g. email, SMS, Slack, etc.) and follow the prompts to set up the channel.
  6. Once the notification channel is set up, click on the “Alerting policies” tab on the left-hand side.
  7. Click on the “Create policy” button at the top of the page.
  8. Give the policy a name and description, and select the appropriate resource type and metric for the policy.
  9. Under the “Conditions” section, set the conditions for the policy to trigger an alert (e.g. if CPU usage exceeds a certain threshold).
  10. Under the “Notification channels” section, select the notification channel that was set up in step 5.
  11. Click on the “Save” button to save the policy.
Once these steps are completed, the misconfiguration “Cloud Monitoring Notification Channel Should Be Enabled” will be remediated for the GCP project.

​

To remediate the misconfiguration “Cloud Monitoring Notification Channel Should Be Enabled” for GCP using GCP CLI, please follow the below steps:Step 1: Open the GCP console and go to the Cloud Monitoring page.Step 2: Click on the “Notification channels” option from the left-hand side menu.Step 3: Click on the ”+ Create channel” button.Step 4: Select the type of notification channel you want to create (Email, SMS, Slack, etc.) and follow the prompts to configure the channel.Step 5: Once you have configured the notification channel, click on the “Test” button to ensure that the notification channel is working correctly.Step 6: Once the test is successful, go back to the Cloud Monitoring page and click on the “Alerting policies” option from the left-hand side menu.Step 7: Click on the alerting policy that you want to update.Step 8: In the “Notifications” section, click on the ”+ Add notification channel” button.Step 9: Select the notification channel that you just created and click on the “Save” button.Step 10: Repeat steps 8-9 for any other alerting policies that you want to update.By following these steps, you should be able to remediate the misconfiguration “Cloud Monitoring Notification Channel Should Be Enabled” for GCP using GCP CLI.
To remediate the misconfiguration “Cloud Monitoring Notification Channel Should Be Enabled” for GCP using Python, follow these steps:
  1. Install the necessary libraries: 
    pip install google-cloud-monitoring google-auth
  2. Authenticate to GCP using a service account key: 
    from google.oauth2 import service_account

credentials = service_account.Credentials.from_service_account_file(
    '/path/to/service_account_key.json')
  3. Create a notification channel: 
    from google.cloud.monitoring_v3 import NotificationChannel
from google.cloud.monitoring_v3 import NotificationChannelDescriptorServiceClient

client = NotificationChannelDescriptorServiceClient(credentials=credentials)

descriptor_name = client.notification_channel_descriptor_path(
    project_id, 'email')

channel = NotificationChannel(
    type_='email',
    display_name='My email',
    labels={
        'email_address': '[email protected]'
    }
)

client.create_notification_channel(
    project_id,
    channel,
    descriptor_name=descriptor_name
)
  4. Verify that the notification channel was created: 
    from google.cloud.monitoring_v3 import NotificationChannelServiceClient

client = NotificationChannelServiceClient(credentials=credentials)

channels = client.list_notification_channels(project_id)

for channel in channels:
    print(channel.display_name)
    This should output the display name of all notification channels in the project, including the one you just created. Note: Make sure to replace project_id and [email protected] with your own values.
With these steps, you should be able to remediate the “Cloud Monitoring Notification Channel Should Be Enabled” misconfiguration for GCP using Python.

​
Additional Reading: