> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Logging Should Be Enabled

### More Info:

Ensures all Kubernetes clusters have logging enabled. This setting should be enabled to ensure Kubernetes control plane logs are properly recorded.

### Risk Level

Medium

### Address

Security

### Compliance Standards

* APRA CPS 234 (Australia)
* BSI C5 (Germany)
* Brazil LGPD
* CCPA / CPRA (California)
* CIS Critical Security Controls v8
* CMMC 2.0
* CSA Cloud Controls Matrix v4
* DPDPA
* Digital Operational Resilience Act (EU)
* HITRUST CSF
* ISO/IEC 27017
* ISO/IEC 27018
* ISO/IEC 27701
* KSA PDPL
* MAS Technology Risk Management (Singapore)
* MITRE ATT\&CK (Cloud)
* NIS2 Directive
* NIST CSF
* NIST SP 800-171
* NYDFS 23 NYCRR 500
* PCI
* SOC2
* SWIFT Customer Security Controls Framework
* Sarbanes-Oxley IT General Controls
* Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
* UK NCSC Cyber Assessment Framework

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Using Console" defaultOpen="true">
        To remediate the misconfiguration "Logging Should Be Enabled" for GCP using GCP console, please follow the below steps:

        1. Login to GCP console ([https://console.cloud.google.com/](https://console.cloud.google.com/)).
        2. Select the project for which you want to enable logging.
        3. In the left navigation menu, select "Logging".
        4. Click on "Log Exports" tab.
        5. Click on "Create Export" button.
        6. Select the logs which you want to export to Stackdriver Logging.
        7. Choose the destination where you want to export logs to (e.g. BigQuery, Pub/Sub, Cloud Storage).
        8. Configure the export settings as per your requirement.
        9. Click on "Create" button.

        Once the above steps are completed, logging will be enabled for your GCP project and you will be able to view logs in the Stackdriver Logging console.

        #
      </Accordion>

      <Accordion title="Using CLI">
        To remediate the misconfiguration "Logging Should Be Enabled" for GCP using GCP CLI, follow these steps:

        1. Open the Cloud Shell in the GCP Console.

        2. Run the following command to enable Stackdriver Logging for all resources in the current project:

           ```
           gcloud logging apply --configuration=cloudaudit.googleapis.com
           ```

        3. If you want to enable Stackdriver Logging for a specific resource, run the following command:

           ```
           gcloud logging apply <resource-type>/<resource-name> --configuration=cloudaudit.googleapis.com
           ```

           Replace `<resource-type>` with the type of resource (e.g. `gce_instance`, `cloud_function`) and `<resource-name>` with the name of the resource.

        4. Verify that Stackdriver Logging is enabled by going to the Logging page in the GCP Console. You should see logs for the resources that you enabled logging for.

        5. Repeat steps 2-4 for all projects and resources in your GCP environment to ensure that logging is enabled for all resources.

        By following these steps, you should be able to remediate the "Logging Should Be Enabled" misconfiguration for GCP using GCP CLI.
      </Accordion>

      <Accordion title="Using Python">
        To remediate the misconfiguration "Logging should be enabled" for GCP using Python, you can follow the below steps:

        1. First, you need to create a service account with the required permissions to enable logging. You can create a service account using the GCP console or using the following Python code:

        ```python theme={null}
        from google.oauth2 import service_account

        credentials = service_account.Credentials.from_service_account_file('path/to/service_account.json')
        ```

        2. Next, you need to enable logging for the GCP project. You can use the `google-cloud-logging` library to enable logging using the following Python code:

        ```python theme={null}
        from google.cloud import logging_v2

        client = logging_v2.LoggingServiceV2Client(credentials=credentials)
        project_name = f"projects/{project_id}"
        project = client.get_project(project_name)

        if not project.logging_enabled:
            project.logging_enabled = True
            update_mask = {"paths": ["logging_enabled"]}
            client.update_project(project=project, update_mask=update_mask)
        ```

        3. Replace `project_id` with the ID of the GCP project for which you want to enable logging.

        4. Finally, run the Python script to enable logging for the GCP project.

        These steps will remediate the misconfiguration "Logging should be enabled" for GCP using Python.
      </Accordion>

      <Accordion title="Using Terraform">
        ```hcl theme={null}
        resource "google_container_cluster" "primary" {
          name     = "PRIMARY_CLUSTER_NAME"      # replace with your cluster name
          location = "GCP_REGION_OR_ZONE"        # e.g. "us-central1" or "us-central1-a"

          # ... other required arguments like network, initial_node_count, etc.

          logging_config {
            enable_components = [
              "SYSTEM_COMPONENTS",
              "WORKLOADS",
              "APISERVER",
              "SCHEDULER",
              "CONTROLLER_MANAGER",
            ]
          }
        }
        ```

        Changing `logging_config` on an existing `google_container_cluster` is an in‑place update and should not force cluster replacement.

        To verify, `terraform plan` should show either creation of the cluster with the `logging_config` block set as above, or an in‑place update adding/modifying the `logging_config.enable_components` list on the existing cluster.
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://cloud.google.com/monitoring/kubernetes-engine/legacy-stackdriver/logging](https://cloud.google.com/monitoring/kubernetes-engine/legacy-stackdriver/logging)