Load Balancer Global Backend Services Should Have Logging Enabled

More Info:

Load balancers global backend services should have request logging enabled. Logging requests to Load Balancer endpoints is a helpful way of detecting and investigating potential attacks.

Risk Level

Medium

Address

Operational Maturity, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CIS GCP 2.0.0
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• FedRAMP
• GDPR
• HITRUST CSF
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• Reserve Bank of India (RBI) Master Direction – Information Technology Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the misconfiguration of Load Balancer Global Backend Services not having logging enabled in GCP, you can follow the below steps using the GCP console:

1. Open the GCP console and navigate to the Load balancing section.
2. Select the Load Balancer for which you want to enable logging.
3. Click on the Edit button on the top of the Load Balancer details page.
4. Scroll down to the Backend configuration section and click on the pencil icon next to the Global backend configuration.
5. In the Global backend configuration settings, scroll down to the Logging section and click on the toggle button to enable logging.
6. Select the appropriate log type from the drop-down menu.
7. Click on the Save button to save the changes.

After following these steps, the Load Balancer Global Backend Services will have logging enabled, and you will be able to view the logs for the Load Balancer in the Logging section of the GCP console.

Using CLI

To remediate the Load Balancer Global Backend Services should have logging enabled in GCP, you can follow the below steps using GCP CLI:

1. Open the Cloud Shell in the GCP Console.

2. Run the following command to enable logging for the backend service:

   gcloud compute backend-services update [BACKEND_SERVICE_NAME] --global --enable-logging
   

   Replace [BACKEND_SERVICE_NAME] with the name of the backend service for which you want to enable logging.

3. Once the command is executed successfully, the logging will be enabled for the backend service.

4. You can verify the logging is enabled by running the following command:

   gcloud compute backend-services describe [BACKEND_SERVICE_NAME] --global | grep loggingEnabled
   

   This command should return the value loggingEnabled: true.

By following the above steps, you can remediate the Load Balancer Global Backend Services should have logging enabled misconfiguration in GCP using GCP CLI.

Using Python

To remediate the misconfiguration of Load Balancer Global Backend Services not having logging enabled in GCP using Python, follow the steps below:

1. Import the necessary libraries:

from googleapiclient.discovery import build
from google.oauth2 import service_account

2. Set up the credentials using the service account key file:

credentials = service_account.Credentials.from_service_account_file('<path_to_service_account_key_file>')

3. Create a service object for the Compute Engine API:

service = build('compute', 'v1', credentials=credentials)

4. Get the project ID:

project_id = '<your_project_id>'

5. Get the list of all the backend services:

backend_services = service.backendServices().list(project=project_id).execute()

6. Loop through the backend services and enable logging for each one:

for backend_service in backend_services['items']:
    backend_service_name = backend_service['name']
    backend_service_url = f'/compute/v1/projects/{project_id}/global/backendServices/{backend_service_name}'
    
    # Get the current backend service configuration
    backend_service_config = service.backendServices().get(project=project_id, backendService=backend_service_name).execute()
    
    # Check if logging is already enabled
    if 'loadBalancingScheme' in backend_service_config and 'logConfig' in backend_service_config['loadBalancingScheme']:
        print(f"Logging is already enabled for backend service {backend_service_name}")
    else:
        # Enable logging
        backend_service_config['loadBalancingScheme']['logConfig'] = {'enable': True}
        request = service.backendServices().update(project=project_id, backendService=backend_service_name, body=backend_service_config)
        request.execute()
        print(f"Logging has been enabled for backend service {backend_service_name}")

7. Run the script and verify that logging has been enabled for all the backend services.

Note: Make sure that the service account used has the necessary permissions to modify the backend services.

Using Terraform

resource "google_compute_backend_service" "GLOBAL_BACKEND_SERVICE" {
  name        = "GLOBAL_BACKEND_SERVICE_NAME" # replace with your backend service name
  protocol    = "HTTP"                        # or HTTPS/HTTP2/other as appropriate
  port_name   = "http"                        # match your existing config
  timeout_sec = 30                            # match your existing config

  # ...your existing backends, health_checks, etc...

  log_config {
    enable      = true
    sample_rate = 1.0 # replace with desired sampling rate between 0.0 and 1.0
  }
}

Changing log_config on google_compute_backend_service is an in-place update and does not force resource replacement.

Verification: terraform plan should show an update to the existing google_compute_backend_service with log_config.enable changing to true (and sample_rate to your chosen value).

Additional Reading:

• https://cloud.google.com/load-balancing/docs/https/https-logging-monitoring
• https://cloud.google.com/load-balancing/docs/l7-internal/monitoring