Back to Checks
gcp

VPC network has Cloud DNS logging enabled

compute_network_dns_logging_enabled
Service: computeSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:compute.googleapis.com/Network

VPC networks are assessed for a DNS policy that enables Cloud DNS query logging. When present, resolvers record queries for the network from VMs, GKE, peering, and inbound forwarding, with entries written to Cloud Logging.

Prowler logoProwlerprowler-provider-gcp

Risk

Without DNS query logs, suspicious lookups (C2, DGA, DNS exfiltration) go unseen, reducing confidentiality and hindering incident response. Visibility gaps also hide misconfigurations and elevated NXDOMAIN rates that can impact the availability of name resolution.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks compute_network_dns_logging_enabled

Recommendation

Enable Cloud DNS query logging for all VPC networks via DNS policies and route logs to centralized analysis. Enforce least privilege on log access, set retention and sampling to manage cost, and add detections for malicious domains. Apply defense in depth with DNS response policies and egress controls.

Remediation

Terraform

resource "google_dns_policy" "<example_resource_name>" {
  name           = "<example_resource_name>"
  enable_logging = true  # CRITICAL: turns on DNS query logging for the policy

  networks {
    network_url = "projects/<PROJECT_ID>/global/networks/<example_resource_name>"  # Attach to the target VPC
  }
}

Other

1In the Google Cloud console, go to Cloud DNS > Policies
2If the VPC already has a policy: select the policy, click Edit, check Enable logging, click Save
3If there is no policy for the VPC: click Create policy, enter a name, check Enable logging, add the target VPC network, click Create

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.compute.compute_client import compute_client
from prowler.providers.gcp.services.dns.dns_client import dns_client


class compute_network_dns_logging_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for network in compute_client.networks:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=network,
                location=compute_client.region,
            )
            report.status = "FAIL"
            report.status_extended = (
                f"Network {network.name} does not have DNS logging enabled."
            )
            for policy in dns_client.policies:
                if network.name in policy.networks and policy.logging:
                    report.status = "PASS"
                    report.status_extended = (
                        f"Network {network.name} has DNS logging enabled."
                    )
                    break
            findings.append(report)

        return findings

References