Detections
Analytics

5.7.1 Ensure Logging and Cloud Monitoring is Enabled

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Send logs and metrics to a remote aggregator to mitigate the risk of local tampering in the event of a breach.

Exporting logs and metrics to a dedicated, persistent datastore such as Cloud Operations for GKE ensures availability of audit data following a cluster security event, and provides a central location for analysis of log and metric data collated from multiple sources.

Solution

Using Google Cloud Console:
To enable Logging:

 - Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
 - Select the cluster for which Logging is disabled.
 - Under the details pane, within the Features section, click on the pencil icon named Edit logging.
 - Check the box next to Enable Logging.
 - In the drop-down Components box, select the components to be logged.
 - Click SAVE CHANGES, and wait for the cluster to update.

To enable Cloud Monitoring:

 - Go to Kubernetes Engine by visiting: https://console.cloud.google.com/kubernetes/list.
 - Select the cluster for which Logging is disabled.
 - Under the details pane, within the Features section, click on the pencil icon named Edit Cloud Monitoring.
 - Check the box next to Enable Cloud Monitoring.
 - In the drop-down Components box, select the components to be logged.
 - Click SAVE CHANGES, and wait for the cluster to update.

Using Command Line:
To enable Logging for an existing cluster, run the following command:

gcloud container clusters update <cluster_name> --location <location> --logging=<components_to_be_logged>

See https://cloud.google.com/kubernetes-engine/docs/how-to/configure-metrics#available-metricsfor a list of available metrics for logging.

To enable Cloud Monitoring for an existing cluster, run the following command:

gcloud container clusters update <cluster_name> --location <location> --monitoring=<components_to_be_logged>

See https://cloud.google.com/kubernetes-engine/docs/concepts/about-logs#available-logsfor a list of available logging values.

See Also

https://workbench.cisecurity.org/benchmarks/24112

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: GCP

Control ID: 9bc70c15e57c4a91ce2771aabfa1e001582ca32b56bcb9724aeff18f1d9ac4a7