Bucket Logging Should Be Enabled

More Info:

Ensures object logging is enabled on storage buckets. Storage bucket logging helps maintain an audit trail of access that can be used in the event of a security incident.

Risk Level

Low

Address

Reliability, Security

Compliance Standards

• APRA CPS 234 (Australia)
• BSI C5 (Germany)
• Brazil LGPD
• CCPA / CPRA (California)
• CIS Critical Security Controls v8
• CMMC 2.0
• CSA Cloud Controls Matrix v4
• DPDPA
• Digital Operational Resilience Act (EU)
• Essential 8
• FedRAMP
• GDPR
• HIPAA
• HITRUST CSF
• ISO 27001
• ISO/IEC 27017
• ISO/IEC 27018
• ISO/IEC 27701
• KSA PDPL
• MAS Technology Risk Management (Singapore)
• MITRE ATT&CK (Cloud)
• NIS2 Directive
• NIST
• NIST CSF
• NIST SP 800-171
• NYDFS 23 NYCRR 500
• PCI
• Reserve Bank of India (RBI) Cyber Security Framework
• SOC2
• SWIFT Customer Security Controls Framework
• Sarbanes-Oxley IT General Controls
• Securities and Exchange Board of India (SEBI) - Cloud Security Adoption Framework
• UK NCSC Cyber Assessment Framework

Triage and Remediation

Remediation

Remediation

Using Console

To remediate the bucket logging misconfiguration in GCP using the GCP console, follow these steps:

1. Open the GCP console and navigate to the Storage section.
2. Select the bucket for which you want to enable logging.
3. Click on the “Edit bucket details” button at the top of the page.
4. Scroll down to the “Logging” section and click on the “Configure” button.
5. In the “Configure logging” dialog box, select the “Cloud Audit Logs” option.
6. Choose the appropriate logs you want to receive and click on the “Save” button.

Once you have completed these steps, bucket logging will be enabled for the selected bucket in GCP. The logs will be stored in the Cloud Audit Logs and can be accessed via the GCP console or through the Cloud Logging API.

Using CLI

To remediate the bucket logging misconfiguration for GCP using GCP CLI, follow these step-by-step instructions:

1. Open the Cloud Shell from the GCP console.

2. Run the following command to list all the buckets in your project:

   gsutil ls
   

3. Choose the bucket for which you want to enable logging.

4. Run the following command to enable logging for the bucket:

   gsutil logging set on -b gs://[BUCKET_NAME] gs://[LOG_BUCKET_NAME]/[PREFIX]
   

   Replace [BUCKET_NAME] with the name of your bucket and [LOG_BUCKET_NAME] with the name of the bucket where you want to store the logs. [PREFIX] is an optional parameter that allows you to specify a prefix for the log object names.

5. Verify that logging has been enabled for the bucket by running the following command:

   gsutil logging get gs://[BUCKET_NAME]
   

   This command will display the current logging configuration for the bucket.

6. You can also view the logs in the log bucket by running the following command:

   gsutil ls gs://[LOG_BUCKET_NAME]/[PREFIX]
   

   This command will list all the log files that have been generated for the specified bucket.

With these steps, you have successfully enabled bucket logging for your GCP bucket using GCP CLI.

Using Python

To remediate the misconfiguration “Bucket Logging Should Be Enabled” in GCP using Python, you can follow the below steps:

1. Import the required libraries:

from google.cloud import storage

2. Set the project ID and bucket name:

project_id = 'your_project_id'
bucket_name = 'your_bucket_name'

3. Create a client object of the storage bucket:

storage_client = storage.Client(project=project_id)
bucket = storage_client.get_bucket(bucket_name)

4. Set the bucket’s logging configuration:

bucket.logging = {'logBucket': 'your_logging_bucket_name', 'logObjectPrefix': 'your_log_object_prefix'}
bucket.patch()

5. Verify the logging configuration by checking the bucket’s logging properties:

bucket.reload()
print(bucket.logging)

The above steps will enable bucket logging for the specified GCP bucket. You can run this Python script as a standalone script or integrate it into your infrastructure as code pipeline.

Using Terraform

resource "google_storage_bucket" "LOG_BUCKET" {
  name                        = "LOG_BUCKET_NAME"          # replace with your existing log bucket name
  location                    = "BUCKET_LOCATION"          # e.g. "US"
  uniform_bucket_level_access = true
}

resource "google_storage_bucket" "TARGET_BUCKET" {
  name                        = "BUCKET_NAME"              # replace with the bucket that needs logging enabled
  location                    = "BUCKET_LOCATION"          # must be compatible with your log bucket's location
  uniform_bucket_level_access = true

  logging {
    log_bucket        = google_storage_bucket.LOG_BUCKET.name
    log_object_prefix = "AccessLog"                        # matches `-o AccessLog` from the gsutil command
  }
}

This change does not force replacement of the existing bucket; it updates its logging configuration in place.

Verification: terraform plan should show an in-place update (~) to the affected google_storage_bucket with a new logging block specifying log_bucket and log_object_prefix.

Additional Reading:

• https://cloud.google.com/storage/docs/access-logs