Logo of Trend Micro
Use the Conformity Knowledge Base AI to help improve your Cloud Posture

Enforce Detailed Audit Logging Mode

Trend Cloud One™ – Conformity is a continuous assurance tool that provides peace of mind for your cloud infrastructure, delivering over 1000 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that "Google Cloud Platform - Detailed Audit Logging Mode" policy is enforced at the organization level in order to enable Detailed Audit Logging feature for the supported Cloud Storage resources available within your GCP organization.

Security

When Detailed Audit Logging is enforced, both the request and response are included in Cloud Audit logs. Logged information includes query parameters, path parameters, and request body parameters but excludes certain parts that are associated with sensitive information such as credentials, encryption keys, secrets, and other privacy-related data. Enabling "Google Cloud Platform - Detailed Audit Logging Mode" organization policy is highly encouraged in coordination with Bucket Lock feature when seeking compliances such as SEC Rule 17a-4(f), CFTC Rule 1.31(c)-(d), and FINRA Rule 4511(c).

Audit

To determine if "Google Cloud Platform - Detailed Audit Logging Mode" policy is enforced at the GCP organization level, perform the following operations:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to examine.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your GCP organization.

05 Click inside the Filter by policy name or ID filter box, select Google Cloud Platform - Detailed Audit Logging Mode to return the "Google Cloud Platform - Detailed Audit Logging Mode" policy.

06 Click on the name of the GCP organization policy returned at the previous step.

07 On the Policy details page, under Effective policy, check the Enforcement configuration attribute status. If the Enforcement attribute status is set to Not enforced, the policy is not enforced for your GCP organization, therefore the Detailed Audit Logging mode is not enabled for the supported Google Cloud Storage resources available within the selected organization.

08 Repeat steps no. 2 – 7 for each organization available in your Google Cloud account.

Using GCP CLI

01 Run organizations list command (Windows/macOS/Linux) using custom query filters to list the ID of each GCP organization created within your Google Cloud account: 

gcloud organizations list
    --format="table(name)"

02 The command output should return the requested organization identifiers (IDs): 

ID
112233441122
123412341234

03 Run resource-manager org-policies describe command (Windows/macOS/Linux) using the ID of the GCP organization that you want to examine as identifier parameter, to describe the enforcement configuration of the "Google Cloud Platform - Detailed Audit Logging Mode" policy, available for the selected organization: 

gcloud alpha resource-manager org-policies describe
"gcp.detailedAuditLoggingMode"
    --effective
    --organization=112233441122
    --format="table(booleanPolicy)"

04 The command request should return the requested configuration information: 

BOOLEAN_POLICY
{}

If the resource-manager org-policies describe command output returns an empty object for the BOOLEAN_POLICY configuration attribute, i.e. {}, the "Google Cloud Platform - Detailed Audit Logging Mode" policy is not enforced at the GCP organization level, therefore the Detailed Audit Logging mode is not enabled for the supported Google Cloud Storage resources deployed in the selected organization.

05 Repeat step no. 3 and 4 for each organization created within your Google Cloud account.

Remediation / Resolution

To enable Detailed Audit Logging mode for the supported Google Cloud Storage resources deployed within your GCP organization, enable the "Google Cloud Platform - Detailed Audit Logging Mode" organization policy by performing the following operations:

Using GCP Console

01 Sign in to Google Cloud Management Console with the organizational unit credentials.

02 Click on the deployment selector from the top navigation bar, select ALL to list all the existing deployments, then choose the Google Cloud organization that you want to reconfigure.

03 Navigate to Cloud Identity and Access Management (IAM) dashboard at https://console.cloud.google.com/iam-admin/iam.

04 In the navigation panel, select Organization Policies to access the list with the cloud organization policies available for your GCP organization.

05 Click inside the Filter by policy name or ID box, select Google Cloud Platform - Detailed Audit Logging Mode to list only the "Google Cloud Platform - Detailed Audit Logging Mode" policy.

06 Click on the name of the GCP organization policy listed at the previous step.

07 On the Policy details page, click on the EDIT button from the dashboard top menu to edit the selected policy.

08 On the Edit policy configuration page, perform the following actions:

  1. Under Applies to, select Customize to choose the type of the policy to apply (i.e. customized policy).
  2. Under Enforcement, select On to enable the "Google Cloud Platform - Detailed Audit Logging Mode" policy for the selected GCP organization.
  3. Click SAVE to apply the changes and enforce the policy at the organization level.

09 If required, repeat steps no. 2 – 8 to enable the necessary policy for other organizations available in your Google Cloud account.

Using GCP CLI

01 Run resource-manager org-policies enable-enforce command (Windows/macOS/Linux) using the ID of the Google Cloud Platform (GCP) organization that you want to reconfigure as identifier parameter, to enforce the "Google Cloud Platform - Detailed Audit Logging Mode" policy (i.e. "gcp.detailedAuditLoggingMode" constraint) for the selected GCP organization: 

gcloud alpha resource-manager org-policies enable-enforce
"gcp.detailedAuditLoggingMode"
    --organization=112233441122

02 The command request should return the reconfigured organization policy metadata: 

booleanPolicy:
  enforced: true
constraint: constraints/gcp.detailedAuditLoggingMode
etag: abcdabcdabcd
updateTime: '2020-09-02T16:00:00.000Z'

03 If required, repeat step no. 1 and 2 to enforce the required policy for other GCP organizations created within your Google Cloud account.

References

Publication date May 10, 2021

Related ResourceManager rules