| name | cis-gcp-foundations-2.4 |
| description | Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes |
| category | cis-gcp-foundations |
| version | 4.0.0 |
| author | cyberstrike-official |
| tags | ["cis","gcp","logging","monitoring","log-metrics","alerts","iam","project-ownership"] |
| cis_id | 2.4 |
| cis_benchmark | CIS Google Cloud Platform Foundation Benchmark v4.0.0 |
| tech_stack | ["gcp"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
Ensure Log Metric Filter and Alerts Exist for Project Ownership Assignments/Changes (Automated)
Description
In order to prevent unnecessary project ownership assignments to users/service-accounts and further misuses of projects and resources, all roles/Owner assignments should be monitored.
Members (users/Service-Accounts) with a role assignment to primitive role roles/Owner are project owners.
The project owner has all the privileges on the project the role belongs to. These are summarized below:
- All viewer permissions on all GCP Services within the project
- Permissions for actions that modify the state of all GCP services within the project
- Manage roles and permissions for a project and all resources within the project
- Set up billing for a project
Granting the owner role to a member (user/Service-Account) will allow that member to modify the Identity and Access Management (IAM) policy. Therefore, grant the owner role only if the member has a legitimate purpose to manage the IAM policy. This is because the project IAM policy contains sensitive access control data. Having a minimal set of users allowed to manage IAM policy will simplify any auditing that may be necessary.
Rationale
Project ownership has the highest level of privileges on a project. To avoid misuse of project resources, the project ownership assignment/change actions mentioned above should be monitored and alerted to concerned recipients.
- Sending project ownership invites
- Acceptance/Rejection of project ownership invite by user
- Adding
role\Owner to a user/service-account
- Removing a user/Service account from
role\Owner
Impact
Enabling logging may result in your project being charged for the additional logs usage.
Audit Procedure
Using Google Cloud Console
Ensure that the prescribed log metric is present:
- Go to
Logging/Log-based Metrics by visiting https://console.cloud.google.com/logs/metrics.
- In the
User-defined Metrics section, ensure that at least one metric <Log_Metric_Name> is present with filter text:
(protoPayload.serviceName="cloudresourcemanager.googleapis.com")
AND (ProjectOwnership OR projectOwnerInvitee)
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="REMOVE"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
OR (protoPayload.serviceData.policyDelta.bindingDeltas.action="ADD"
AND protoPayload.serviceData.policyDelta.bindingDeltas.role="roles/owner")
