Back to Checks
gcp

HTTP(S) load balancer has logging enabled

compute_loadbalancer_logging_enabled
Service: computeSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:compute.googleapis.com/BackendService

Application Load Balancer (HTTP/S) backend services have Cloud Logging for requests enabled at the backend service level.

Only load balancers with a backend service support this setting.

Prowler logoProwlerprowler-provider-gcp

Risk

Without request logs, visibility into HTTP(S) traffic is reduced, hindering detection of credential stuffing, path traversal, WAF bypass, and data exfiltration. This impacts confidentiality and integrity, and delays incident response; availability issues (surges in 5xx) may go unnoticed.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_loadbalancer_logging_enabled

Recommendation

Enable request logging on backend services with a risk-appropriate sampleRate; include key optional fields when needed. Export logs to monitoring for alerts and dashboards, enforce retention and integrity controls, and restrict access using least privilege and defense in depth.

Remediation

CLI

gcloud compute backend-services update <example_resource_name> --global --enable-logging

Terraform

resource "google_compute_backend_service" "<example_resource_name>" {
  name          = "<example_resource_name>"
  health_checks = ["<example_health_check_self_link>"]

  log_config {
    enable = true # Critical: enables logging on the backend service
  }
}

Other

1In Google Cloud Console, go to Networking > Load balancing
2Click your HTTP(S) load balancer, then click Edit
3Open Backend configuration and click Edit next to the backend service
4Check Enable logging
5Click Update (backend service), then Update (load balancer)
6Verify logs appear in Logs Explorer under Cloud HTTP Load Balancer

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client


class compute_loadbalancer_logging_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for lb in compute_client.load_balancers:
            # Only load balancers with backend service can have logging enabled
            if lb.service:
                report = Check_Report_GCP(
                    metadata=self.metadata(),
                    resource=lb,
                    location=compute_client.region,
                )
                report.status = "PASS"
                report.status_extended = f"LoadBalancer {lb.name} has logging enabled."
                if not lb.logging:
                    report.status = "FAIL"
                    report.status_extended = (
                        f"LoadBalancer {lb.name} does not have logging enabled."
                    )
                findings.append(report)

        return findings

References