cis-gcp-foundations-2-2

name	cis-gcp-foundations-2.2
description	Ensure That Sinks Are Configured for All Log Entries
category	cis-gcp-foundations
version	4.0.0
author	cyberstrike-official
tags	["cis","gcp","logging","monitoring","log-sinks","cloud-audit"]
cis_id	2.2
cis_benchmark	CIS Google Cloud Platform Foundation Benchmark v4.0.0
tech_stack	["gcp"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

Ensure That Sinks Are Configured for All Log Entries (Automated)

Description

It is recommended to create a sink that will export copies of all the log entries. This can help aggregate logs from multiple projects and export them to a Security Information and Event Management (SIEM).

Rationale

Log entries are held in Cloud Logging. To aggregate logs, export them to a SIEM. To keep them longer, it is recommended to set up a log sink. Exporting involves writing a filter that selects the log entries to export, and choosing a destination in Cloud Storage, BigQuery, or Cloud Pub/Sub. The filter and destination are held in an object called a sink. To ensure all log entries are exported to sinks, ensure that there is no filter configured for a sink. Sinks can be created in projects, organizations, folders, and billing accounts.

Impact

There are no costs or limitations in Cloud Logging for exporting logs, but the export destinations charge for storing or transmitting the log data.

Audit Procedure

Using Google Cloud Console

1. Go to Logs Router by visiting https://console.cloud.google.com/logs/router.
2. For every sink, click the 3-dot button for Menu options and select View sink details.
3. Ensure there is at least one sink with an empty Inclusion filter.
4. Additionally, ensure that the resource configured as Destination exists.

Using Google Cloud CLI

1. Ensure that a sink with an empty filter exists. List the sinks for the project, folder or organization. If sinks are configured at a folder or organization level, they do not need to be configured for each project:

gcloud logging sinks list --folder=FOLDER_ID | --organization=ORGANIZATION_ID | --project=PROJECT_ID

The output should list at least one sink with an empty filter.

2. Additionally, ensure that the resource configured as Destination exists.

See https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list for more information.

Expected Result

At least one sink with an empty filter is configured, and the destination resource exists.

Remediation

Using Google Cloud Console

1. Go to Logs Router by visiting https://console.cloud.google.com/logs/router.