Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in TrendAI Vision One™ Cloud Risk Management. For details, please refer to Upgrade to TrendAI Vision One™
Logo of TrendAI

Enable Access Transparency

TrendAI Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1400 automated best practice checks.

Risk Level: Medium (should be achieved)

Ensure that the Access Transparency feature is enabled in your Google Cloud Platform (GCP) organization in order to provide increased visibility into the actions taken by Google personnel on your cloud data, enhancing security and accountability.

Security

Access Transparency provides GCP customers with detailed logs and visibility into the actions performed by Google personnel on their data. It offers transparency and auditability, allowing customers to monitor and verify any access made by Google administrators or support engineers to their GCP cloud resources. Access Transparency helps enhance security, compliance, and trust in the cloud environment.

Audit

To determine if the Access Transparency feature is enabled within your Google Cloud organization, perform the following operations:

Checking for Access Transparency feature using GCP Command Line Interface (gcloud) is not currently supported.

Using GCP Console

  1. Sign in to the Google Cloud Management Console with the organizational unit credentials.

  2. Select the GCP organization that you want to examine from the console top navigation bar.

  3. Navigate to IAM and Admin console available at https://console.cloud.google.com/iam-admin/iam.

  4. In the main navigation panel, choose Settings.

  5. Check the status of the Access Transparency feature, available under Access Transparency. If the status is not set to Enabled, Access Transparency is disabled for the selected Google Cloud organization.

  6. Repeat steps no. 2 – 5 for each GCP organization available in your Google account.

Remediation / Resolution

To ensure that Access Transparency feature is enabled within your Google Cloud organization, perform the following operations:

Enabling the Access Transparency feature using GCP Command Line Interface (gcloud) is not currently supported.

Using GCP Console

  1. Sign in to the Google Cloud Management Console with the organizational unit credentials.

  2. Select the GCP organization that you want to configure from the console top navigation bar.

  3. Navigate to IAM and Admin console available at https://console.cloud.google.com/iam-admin/iam.

  4. In the main navigation panel, choose IAM.

  5. Select the PERMISSIONS tab, choose View by principals, and select GRANT ACCESS to add a new principal.

  6. In the New principals box, enter your user/group email address.

  7. Click inside the Select a role box, and choose the Access Transparency Admin role from the Roles menu.

  8. Choose SAVE to save the changes.

  9. Navigate to Billing console available at https://console.cloud.google.com/billing and make sure that the selected GCP organization has an active billing account with the required support subscription.

  10. Navigate back to the IAM and Admin console at https://console.cloud.google.com/iam-admin/iam.

  11. In the main navigation panel, choose Settings.

  12. Under Access Transparency, choose ENABLE ACCESS TRANSPARENCY FOR ORGANIZATION to enable the Access Transparency feature. IMPORTANT: In order to enable Access Transparency, your organization must have an Enhanced Support or Premium Support subscription.

  13. Repeat steps no. 2 – 12 for each GCP organization available in your Google account.

References

Publication date Jul 13, 2023

Related CloudIAM rules