Detections
Analytics

5.7.1 Enable Cloud Logging and Cloud Monitoring for GKE clusters

Information

Enable Cloud Logging and Cloud Monitoring for GKE clusters so cluster, system, and workload telemetry is sent to centralized Google Cloud observability services. This helps preserve logs and metrics outside the cluster for troubleshooting, security, performance analysis, and alerts.

GKE logs stored only on nodes or within the cluster are not durable because local container logs, system logs, and cluster events can be removed as Pods are deleted, disks fill, or logs age out. Cloud Logging provides a dedicated persistent datastore where events can be searched, analyzed, retained, routed, and correlated after a security event.

Cloud Monitoring collects GKE metrics that can be used for dashboards, alerting, trend analysis, and integration with other monitoring workflows. Enabling both services improves visibility across clusters and helps detect failures, capacity, workload changes, and security.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Enable Cloud Logging and Cloud Monitoring for the required GKE components. At minimum, enable system logging and system monitoring so cluster operations, troubleshooting, and security investigations have centralized telemetry. Enable workload logging when application logs should be collected in Cloud Logging.

gcloud container clusters update $CLUSTER_NAME \\
 --location $LOCATION \\
 --project $PROJECT_ID \\
 --logging=SYSTEM,WORKLOAD \\
 --monitoring=SYSTEM

 - Note: If additional observability is required, enable the appropriate monitoring components such as API server, scheduler, controller manager, kube state, cAdvisor, kubelet, storage, or GPU metrics based on the cluster's operational requirements.

Impact:

Enabling Cloud Logging and Cloud Monitoring can increase telemetry volume and cost, especially for high volume workload logs or expanded metrics collection. Configure log retention, exclusions, sinks, alerting policies, dashboards, and access controls to align with security and compliance requirements.

See Also

https://workbench.cisecurity.org/benchmarks/24956

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2

Plugin: GCP

Control ID: 0d941ad7c56e0540ddc4b16303216e238ff9f548ecdaa4cc259eb3c07f0c3c5c