Back to Checks
gcp

Cloud Storage buckets have Usage and Storage Logs enabled

cloudstorage_bucket_logging_enabled
Service: cloudstorageSeverity: medium
OfficialBuilt-inVerified
Categories:logging
Resource Type:storage.googleapis.com/Bucket

Google Cloud Storage buckets are evaluated to ensure that Usage and Storage Logs are enabled. Enabling these logs provides detailed visibility into access requests, usage patterns, and storage activity within each bucket.

Prowler logoProwlerprowler-provider-gcp

Risk

Buckets without Usage and Storage Logs enabled lack visibility into access and storage activity, which increases the risk of undetected data exfiltration, misuse, or configuration errors.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks cloudstorage_bucket_logging_enabled

Recommendation

Enable Usage and Storage Logs for all Cloud Storage buckets to track access, detect anomalies, and maintain audit visibility of data operations.

Remediation

CLI

gsutil logging set on -b gs://<LOGGING_BUCKET> -o <LOG_OBJECT_PREFIX> gs://<BUCKET_NAME>

Terraform

# Example: enable Usage and Storage Logs on a Cloud Storage bucket
resource "google_storage_bucket" "example" {
  name     = var.bucket_name
  location = var.location

  logging {
    log_bucket        = var.log_bucket_name
    log_object_prefix = "${var.bucket_name}/"
  }
}

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudstorage.cloudstorage_client import (
    cloudstorage_client,
)


class cloudstorage_bucket_logging_enabled(Check):
    """
    Ensure Cloud Storage buckets have Usage and Storage Logs enabled.

    Reports PASS if a bucket has logging configured (logBucket defined),
    otherwise FAIL.
    """

    def execute(self) -> list[Check_Report_GCP]:
        findings = []

        for bucket in cloudstorage_client.buckets:
            report = Check_Report_GCP(metadata=self.metadata(), resource=bucket)
            report.status = "FAIL"
            report.status_extended = (
                f"Bucket {bucket.name} does not have Usage and Storage Logs enabled."
            )

            if bucket.logging_bucket:
                report.status = "PASS"
                if bucket.logging_prefix:
                    report.status_extended = (
                        f"Bucket {bucket.name} has Usage and Storage Logs enabled. "
                        f"Logs are stored in bucket '{bucket.logging_bucket}' with prefix '{bucket.logging_prefix}'."
                    )
                else:
                    report.status_extended = (
                        f"Bucket {bucket.name} has Usage and Storage Logs enabled. "
                        f"Logs are stored in bucket '{bucket.logging_bucket}' with default prefix."
                    )

            findings.append(report)

        return findings

References