Control: 2.5 Ensure that the log metric filter and alerts exist for Audit Configuration changes

Description

Google Cloud Platform (GCP) services write audit log entries to the Admin Activity and Data Access logs to help answer the questions of, "who did what, where, and when?" within GCP projects.

Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services.

Admin activity and data access logs produced by cloud audit logging enable security analysis, resource change tracking, and compliance auditing.

Configuring the metric filter and alerts for audit configuration changes ensures the recommended state of audit configuration is maintained so that all activities in the project are audit-able at any point in time.

Remediation

From Console

Create a required log metric:

1. Login to GCP console and navigate to Logs-based Metrics.
2. Click CREATE METRIC.
3. Select Metric Type as Counter, enter Log metric name and Units to 1.
4. Clear any text in the Build filter field and add below text

protoPayload.methodName="SetIamPolicy" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*

5. Click CREATE METRIC. The logs display based on the filter text entered by the user.

Create a required alert policy for the log metric::

1. Identify the newly created metric under the section User-defined Metrics.
2. Click the 3-dot icon in the right most column for the desired metric and select Create alert from metric. A new page opens.
3. Fill out the alert policy configuration and click Save. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value will ensure that a notification is triggered for every owner change in the project.
4. Configure the desired notifications channels in the section Notifications.
5. Enter Alert name and click Save.

From Command Line

Create a required log metric:

• Use the command: gcloud beta logging metrics create.
• Reference for Command Usage.

Create a alert policy for the log metric:

• Use the command: gcloud alpha monitoring policies create.
• Reference for Command Usage.