lacework-global-246
This rule has been split and is linked to lacework-global-489. See Adjusted Rules for CIS GCP 1.3.0 for further details.
2.2 Configure Sinks for All Log Entries (Automated)
Profile Applicability
• Level 1
Description
Best practices recommend creating a sink to export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).
Rationale
Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.
Impact
There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.
Audit
From Console:
Go to
Logs Router
by visiting https://console.cloud.google.com/logs/router.For every sink, click the 3-dot button for Menu options and select
View sink details
.Ensure there is at least one sink with an
empty
Inclusion filter.Additionally, ensure that the resource configured as
Destination
exists.
From Command Line:
- Ensure that a sink with an
empty filter
exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project:
gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID
The output should list at least one sink with an empty filter
.
- Additionally, ensure that the resource configured as
Destination
exists.
See https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list for more information.
Remediation
From Console:
Go to
Logs Router
by visiting https://console.cloud.google.com/logs/router.Click the arrow symbol with
Create Sink
text.Fill out the fields for
Sink details
.Choose Cloud Logging bucket in the Select sink destination drop down menu.
Choose a log bucket in the next drop down menu.
If an inclusion filter is not provided for this sink, the destination provided previously receives all ingested logs. This may result in higher than expected resource usage.
Click
Create Sink
.
For more information, see https://cloud.google.com/logging/docs/export/configure_export_v2#dest-create.
From Command Line:
To create a sink to export all log entries in a Google Cloud Storage bucket:
gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME
You can create sinks for a folder or organization, which includes all projects.
gcloud logging sinks create <sink-name> storage.googleapis.com/DESTINATION_BUCKET_NAME --include-children --folder=FOLDER_ID | --organization=ORGANIZATION_ID
A sink created by the preceding command exports logs in storage buckets. However, you can configure sinks to export logs into
BigQuery
, orCloud Pub/Sub
, orCustom Destination
.While creating a sink, the sink option
--log-filter
is not used to ensure the sink exports all log entries.You can create a sink can at a folder or organization level that collects the logs of all the projects underneath bypassing the option
--include-children
in the gcloud command.
References
https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
https://cloud.google.com/logging/quotas
https://cloud.google.com/logging/docs/routing/overview
https://cloud.google.com/logging/docs/export/using_exported_logs
https://cloud.google.com/logging/docs/export/configure_export_v2
https://cloud.google.com/logging/docs/export/aggregated_exports
https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list
Additional Information
Command-Line Audit and Remediation uses the sink destination of type Cloud Storage Bucket
. However, you can configure the destination to Cloud Storage Bucket
or BigQuery
or Cloud Pub\Sub
or Custom Destination
. Command Line Interface commands would change accordingly.