Enable Usage and Storage Logs for Cloud Storage Buckets

ID: gcloud-storage-logs-not-enabled

Severity: medium

Author: princechaddha

Tags: cloud,devops,gcp,gcloud,google-cloud-storage,logging,security,gcp-cloud-config

Description

Ensure that usage and storage logs are enabled for your Google Cloud Storage buckets to monitor activity, track costs, detect suspicious behavior, and ensure compliance with security and audit requirements.

YAML Source

id: gcloud-storage-logs-not-enabled

info:
  name: Enable Usage and Storage Logs for Cloud Storage Buckets
  author: princechaddha
  severity: medium
  description: |
    Ensure that usage and storage logs are enabled for your Google Cloud Storage buckets to monitor activity, track costs, detect suspicious behavior, and ensure compliance with security and audit requirements.
  impact: |
    Without usage and storage logs, it is challenging to monitor access patterns, detect anomalies, and ensure compliance with organizational policies and security standards.
  remediation: |
    Enable usage and storage logs for your Google Cloud Storage buckets to gain visibility into bucket activity and ensure audit compliance.
  reference:
    - https://cloud.google.com/storage/docs/access-logs
  tags: cloud,devops,gcp,gcloud,google-cloud-storage,logging,security,gcp-cloud-config

flow: |
  code(1)
  for(let projectId of iterate(template.projectIds)){
    set("projectId", projectId)
    code(2)
    for(let bucketName of iterate(template.buckets)){
      set("bucketName", bucketName)
      code(3)
    }
  }

self-contained: true

code:
  - engine:
      - sh
      - bash
    source: |
      gcloud projects list --format="json(projectId)"

    extractors:
      - type: json
        name: projectIds
        internal: true
        json:
          - '.[].projectId'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets list --project $projectId --format="json(name)"

    extractors:
      - type: json
        name: buckets
        internal: true
        json:
          - '.[].name'

  - engine:
      - sh
      - bash
    source: |
      gcloud storage buckets describe gs://$bucketName --format="json(logging_config)" | jq -r '. // "null"'

    matchers:
      - type: word
        words:
          - 'null'

    extractors:
      - type: dsl
        dsl:
          - '"Usage and storage logs are not enabled for the bucket " + bucketName + " in project " + projectId'
# digest: 4a0a00473045022100d61a117a25037dacaf959704978b64c51c11b3427a2d69317d4d9898d1f6994c0220338a8a8064b4bacc2ee1b727da99c426b1bb78ca31987ad56cff652919df95c4:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "cloud/gcp/storage/gcloud-storage-logs-not-enabled.yaml"

View on Github