Audit Configuration Logging
Ensures that logging and log alerts exist for audit configuration changes.
Project Ownership is the highest level of privilege on a project, any changes in audit configuration should be heavily monitored to prevent unauthorized changes.
Recommended Actions
Follow the appropriate remediation steps below to resolve the issue.
-
Log into the Google Cloud Platform Console.
-
Scroll down the left navigation panel and select the “Logging” option under the “STACKDRIVER.”
-
On the “Stack driver Logging” page, click on the dropdown menu below the “CREATE METRIC” and choose the “Metric type” from the menu to choose the “Audit Configuration Changes.”
-
If the “Audit Configuration changes” contains no logs information, then the selected metric don’t have logging and log alerts exist for audit configuration changes.
-
Repeat steps number 2 - 4 to check other “Metric type” in the accounts.
-
Navigate to the “Logging” option under the “STACKDRIVER”, click on the dropdown menu below the “CREATE METRIC” and choose the “Metric type” from the menu to choose the “Audit Configuration Changes” to create a new metric for logging and log alerts.
-
Click on the “CREATE METRIC” at the top to create a new metric.
-
On the “Metric editor” tab, enter the “Name” and “Description” accordingly and enter the field name under the “Label” as per the requirements and click on the “Done” button to save the “Label.”
-
Click on the “Create metric” button at the bottom to make the changes.
-
Repeat steps number 6 - 9 to ensure that log alerts exist for audit configuration changes.