Configure Audit Logging | Vulnerability Database

IAM Audit Not Properly Configured

IAM Audit Logging should be configured for all services and the appropriate log types to track changes and accesses.

Impact

Recommended Actions

Follow the appropriate remediation steps below to resolve the issue.

Configure IAM Audit Logs for required services and log types. In Terraform, use google_project_iam_audit_config to specify the services and log types (ADMIN_READ, DATA_READ, DATA_WRITE) to be audited. Note: DATA_READ and DATA_WRITE audit logs can generate significant volumes and costs for high-traffic applications. Consider implementing exemptions for service accounts and evaluating cost implications before enabling for all services.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13


resource "google_project_iam_audit_config" "config" {
  project = "your-project-id"
  service = "allServices"
  audit_log_config {
    log_type = "ADMIN_READ"
  }
  audit_log_config {
    log_type = "DATA_READ"
  }
  audit_log_config {
    log_type = "DATA_WRITE"
  }
}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16


resource "google_project_iam_audit_config" "config" {
  project = "your-project-id"
  service = "allServices"
  audit_log_config {
    log_type = "ADMIN_READ"
  }
  audit_log_config {
    log_type = "DATA_READ"
  }
  audit_log_config {
    log_type = "DATA_WRITE"
    exempted_members = [
      "serviceAccount:specific-service@project.iam.gserviceaccount.com",
    ]
  }
}

Remediation Links

https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/google_project_iam#google_project_iam_audit_config