gcloud-storage-logs-not-enabled: Enable Usage and Storage Logs for Cloud Storage Buckets

id: gcloud-storage-logs-not-enabled

info:
  name: Enable Usage and Storage Logs for Cloud Storage Buckets
  author: princechaddha
  severity: medium
  description: |
    Ensure that usage and storage logs are enabled for your Google Cloud Storage buckets to monitor activity, track costs, detect suspicious behavior, and ensure compliance with security and audit requirements.
  impact: |
    Without usage and storage logs, it is challenging to monitor access patterns, detect anomalies, and ensure compliance with organizational policies and security standards.
  remediation: |
    Enable usage and storage logs for your Google Cloud Storage buckets to gain visibility into bucket activity and ensure audit compliance.
  reference:
    - https://cloud.google.com/storage/docs/access-logs
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,logging,security,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let bucketName of iterate(template.buckets)){
      set("bucketName", bucketName)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: buckets
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets describe gs://$bucketName --format="json(logging_config)" | jq -r '. // "null"'

    matchers:
      - type: word
        words:
          - 'null'

    extractors:
      - type: dsl
        dsl:
          - '"Usage and storage logs are not enabled for the bucket " + bucketName + " in project " + projectId'
# digest: 4a0a00473045022100d61a117a25037dacaf959704978b64c51c11b3427a2d69317d4d9898d1f6994c0220338a8a8064b4bacc2ee1b727da99c426b1bb78ca31987ad56cff652919df95c4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.