MEDIUM
Source
Trivy
ID
AVD-GCP-0077

Cloud Storage Bucket Logging Not Enabled

Cloud Storage bucket access logs should be enabled for audit purposes.

Impact

Follow the appropriate remediation steps below to resolve the issue.

Enable Access and Storage logs for Cloud Storage buckets by configuring a log sink or specifying a log_bucket in Terraform.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
# Bucket with logging configured
resource "google_storage_bucket" "default" {
  name                        = "my-default-bucket"
  location                    = "EU"
  force_destroy               = true
  uniform_bucket_level_access = true

  logging {
    log_bucket = "my-log-bucket"
  }
}
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
# Multiple buckets where log bucket doesn't need its own logging
resource "google_storage_bucket" "application_bucket" {
  name                        = "my-app-bucket"
  location                    = "EU"
  force_destroy               = true
  uniform_bucket_level_access = true

  logging {
    log_bucket = "my-log-bucket"
  }
}

resource "google_storage_bucket" "log_bucket" {
  name                        = "my-log-bucket"
  location                    = "EU"
  force_destroy               = true
  uniform_bucket_level_access = true
  # No logging required since this bucket is used as a log bucket
}