Back to Checks
gcp

GCP project has Cloud Audit Logs enabled

iam_audit_logs_enabled
Service: iamSeverity: medium
OfficialBuilt-inVerified
Categories:loggingforensics-ready
Resource Type:cloudresourcemanager.googleapis.com/Project

GCP project has Cloud Audit Logs configured to capture administrative operations and data access events for services and principals (per IAM Audit Logs, including ADMIN_READ, DATA_READ, DATA_WRITE).

Prowler logoProwlerprowler-provider-gcp

Risk

Absent or partial audit logging reduces visibility into who accessed data or changed configurations, hindering detection and forensics.

Misused identities can alter IAM to persist access, exfiltrate data, or delete resources, impacting confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler gcp --checks iam_audit_logs_enabled

Recommendation

Enable comprehensive Cloud Audit Logs for all services and principals, including ADMIN_READ, DATA_READ, DATA_WRITE. Avoid exemptions. Set org/folder defaults, centralize and retain logs, enforce least privilege on log access, protect logs from alteration, and alert on anomalous access.

Remediation

Terraform

# Enable Cloud Audit Logs (Data Access) for all services
resource "google_project_iam_audit_config" "all" {
  project = "<example_resource_id>"
  service = "allServices" # Critical: apply to all services

  # Critical: enable Data Access audit log types to pass the check
  audit_log_config { log_type = "ADMIN_READ" }  # metadata/config reads
  audit_log_config { log_type = "DATA_READ" }   # data reads
  audit_log_config { log_type = "DATA_WRITE" }  # data writes
}

Other

1In the Google Cloud console, go to IAM & Admin > Audit Logs
2Click Set default configuration
3Under Permission types, check Admin Read, Data Read, and Data Write
4Click Save

Check Code

from prowler.lib.check.models import Check, Check_Report_GCP
from prowler.providers.gcp.services.cloudresourcemanager.cloudresourcemanager_client import (
    cloudresourcemanager_client,
)


class iam_audit_logs_enabled(Check):
    def execute(self) -> Check_Report_GCP:
        findings = []
        for project in cloudresourcemanager_client.cloud_resource_manager_projects:
            report = Check_Report_GCP(
                metadata=self.metadata(),
                resource=cloudresourcemanager_client.projects[project.id],
                project_id=project.id,
                location=cloudresourcemanager_client.region,
                resource_name=(
                    cloudresourcemanager_client.projects[project.id].name
                    if cloudresourcemanager_client.projects[project.id].name
                    else "GCP Project"
                ),
            )
            report.status = "PASS"
            report.status_extended = f"Audit Logs are enabled for project {project.id}."
            if not project.audit_logging:
                report.status = "FAIL"
                report.status_extended = (
                    f"Audit Logs are not enabled for project {project.id}."
                )
            findings.append(report)

        return findings

References