Control: Ensure that the log metric filter and alerts exist for Audit Configuration changes

Description

Cloud audit logging records information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by GCP services. Cloud audit logging provides a history of GCP API calls for an account, including API calls made via the console, SDKs, command-line tools, and other GCP services.

Usage

Run the control in your terminal:

powerpipe control run gcp_compliance.control.logging_metric_alert_audit_configuration_changes

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run gcp_compliance.control.logging_metric_alert_audit_configuration_changes --share

SQL

This control uses a named query:

with filter_data as (
  select
    m.project as project,
    display_name alert_name,
    count(m.name) metric_name
  from
    gcp_monitoring_alert_policy,
    jsonb_array_elements(conditions) as filter_condition
    join gcp_logging_metric m on m.filter ~ '\s*protoPayload.methodName\s*=\s*"SetIamPolicy"\s*AND\s*protoPayload.serviceData.policyDelta.auditConfigDeltas:\*\s*'
    and filter_condition -> 'conditionThreshold' ->> 'filter' like '%metric.type="' || m.metric_descriptor_type || '"%'
  where
    enabled
  group by
    m.project, display_name, m.name
)
select
  'https://cloudresourcemanager.googleapis.com/v1/projects/' || project_id resource,
  case
    when d.metric_name > 0 then 'ok'
    else 'alarm'
  end as status,
  case
    when d.metric_name > 0
      then 'Log metric and alert exist for audit configuration changes.'
    else 'Log metric and alert do not exist for audit configuration changes.'
  end as reason
  
  , project_id as project
from
  gcp_project as p
  left join filter_data as d on d.project = p.name;

Control: Ensure that the log metric filter and alerts exist for Audit Configuration changes

Description

Usage

SQL

Tags