lacework-global-247
Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes (Automated)
Profile Applicability
• Level 1
Description
In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, monitor all roles/Owner
assignments.
Members (users/Service-Accounts) with a role assignment to primitive role roles/Owner
are project owners.
The project owner has all the privileges on the project the role belongs to, summarized below:
- All viewer permissions on all GCP Services within the project
- Permissions for actions that modify the state of all GCP services within the project
- Manage roles and permissions for a project and all resources within the project
- Set up billing for a project
Granting the owner role to a member (user/Service-Account) allows that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy simplifies any auditing that may be necessary.
Rationale
Project ownership has the highest level of privileges on a project. To avoid misuse of project resources, the project ownership assignment/change actions mentioned above should be monitored and alerted to concerned recipients.
- Sending project ownership invites
- Acceptance/Rejection of project ownership invite by user
- Adding `role\Owner` to a user/service-account
- Removing a user/Service account from `role\Owner`
Impact
Enabling of logging may result in your project being charged for the additional logs usage.
Audit
From Console:
Ensure that the prescribed log metric is present:
- Go to
Logging/Log-based Metrics
by visiting https://console.cloud.google.com/logs/metrics. - In the
User-defined Metrics
section, ensure that at least one metric<Log_Metric_Name>
is present with filter text:
(protoPayload.serviceName="cloudresourcemanager.googleapis.com")
AND (ProjectOwnership OR projectOwnerInvitee)
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
Ensure that the prescribed Alerting Policy is present:
- Go to
Alerting
by visiting https://console.cloud.google.com/monitoring/alerting. - Under the
Policies
section, ensure that at least one alert policy exists for the log metric above. Clicking on the policy should show that it is configured with a condition. For example,Violates when: Any logging.googleapis.com/user/<Log Metric Name> stream
is above a threshold of zero(0) for greater than zero(0) seconds
means that the alert will trigger for any new owner change. Verify that the chosen alerting thresholds make sense for your organization. - Ensure that the appropriate notifications channels have been set up.
From Command Line:
Ensure that the prescribed log metric is present:
- List the log metrics:
gcloud beta logging metrics list --format json
- Ensure that the output contains at least one metric with filter set to:
(protoPayload.serviceName="cloudresourcemanager.googleapis.com")
AND (ProjectOwnership OR projectOwnerInvitee)
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
- Note the value of the property
metricDescriptor.type
for the identified metric, in the formatlogging.googleapis.com/user/<Log Metric Name>
.
Ensure that the prescribed alerting policy is present:
- List the alerting policies:
gcloud alpha monitoring policies list --format json
- Ensure that the output contains an least one alert policy where:
conditions.conditionThreshold.filter
is set tometric.type=\"logging.googleapis.com/user/<Log Metric Name>\"
- AND
enabled
is set totrue
Remediation
From Console:
Create the prescribed log metric:
- Go to
Logging/Logs-based Metrics
by visiting https://console.cloud.google.com/logs/metrics and click "CREATE METRIC". - Click the down arrow symbol on the
Filter Bar
at the rightmost corner and selectConvert to Advanced Filter
. - Clear any text and add:
(protoPayload.serviceName="cloudresourcemanager.googleapis.com")
AND (ProjectOwnership OR projectOwnerInvitee)
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
- Click
Submit Filter
. The logs display based on the filter text entered by the user. - In the
Metric Editor
menu on the right, fill out the name field. SetUnits
to1
(default) and theType
toCounter
. This ensures that the log metric counts the number of log entries matching the advanced logs query. - Click
Create Metric
.
Create the display prescribed Alert Policy:
- Identify the newly created metric under the section
User-defined Metrics
at https://console.cloud.google.com/logs/metrics. - Click the 3-dot icon in the rightmost column for the desired metric and select
Create alert from Metric
. A new page opens. - Fill out the alert policy configuration and click
Save
. Choose the alerting threshold and configuration that makes sense for the user's organization. For example, a threshold of zero(0) for the most recent value triggers a notification for every owner change in the project:
Set Aggregator to Count
Set Configuration:
- Condition: above
- Threshold: 0
- For: most recent value
- Configure the desired notifications channels in the section
Notifications
. - Name the policy and click
Save
.
From Command Line:
Create a prescribed Log Metric:
- Use the command: gcloud beta logging metrics create
- Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/beta/logging/metrics/create
Create prescribed Alert Policy:
- Use the command: gcloud alpha monitoring policies create
- Reference for Command Usage: https://cloud.google.com/sdk/gcloud/reference/alpha/monitoring/policies/create
References
https://cloud.google.com/logging/docs/logs-based-metrics/
https://cloud.google.com/monitoring/custom-metrics/
https://cloud.google.com/monitoring/alerts/
https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
Additional Information
- It is not possible to assign project ownership for a user using the gcloud utility, as assigning project ownership to a user requires sending, and the user accepting, an invitation.
- Project Ownership assignment to a service account does not send any invites. SetIAMPolicy to
role/owner
is directly performed on service accounts.