# 2.1 Ensure Cloud Audit Logging Is Configured Properly (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232946-21-ensure-cloud-audit-logging-is-configured-properly-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) #### Profile Applicability:Level 1 ### Description: It is recommended to configure Cloud Audit Logging to monitor administrative actions and access to user data. Proper configuration includes enabling audit logs for Admin Activity, Data Read, and Data Write for all services and ensuring no exemptions for any users. ### Rationale: Google Cloud provides two types of audit logs: 1. Admin Activity Logs: Tracks administrative changes to configuration or metadata (enabled by default). 2. Data Access Logs: Tracks API calls that read, write, or modify user data (disabled by default). Enabling both types ensures: - Visibility into administrative activities. - Monitoring of data access for compliance and security. - Detailed tracking of all user interactions. ### Impact: - Cost: Admin Activity logs are free. Data Access logs may incur additional charges depending on log volume and storage. ### Default Value: - Admin Activity Logs: Enabled by default. - Data Access Logs: Disabled by default. ### Audit Steps: #### Using Google Cloud Console: 1. Navigate to Audit Logs: [Audit Logs Console](https://console.cloud.google.com/iam-admin/audit).                       ![](https://support.icompaas.com/assets/kb/bcfb067997cb3234.png) 2. Confirm that Admin Read, Data Write, and Data Read logs are enabled for all services.                        ![](https://support.icompaas.com/assets/kb/69a806bc36fa7f72.png) 3. Ensure that no users are exempted from logging. #### Using Google Cloud CLI: List the IAM policies for a project, folder, or organization: gcloud organizations get-iam-policy ORGANIZATION\_ID gcloud resource-manager folders get-iam-policy FOLDER\_ID gcloud projects get-iam-policy PROJECT\_ID Verify that the auditConfigs section includes the following: auditConfigs: \- auditLogConfigs: - logType: ADMIN\_READ - logType: DATA\_WRITE - logType: DATA\_READ service: allServices 1. Ensure no exemptedMembers are listed in any auditConfigs sections. ### Remediation Steps: #### Using Google Cloud Console: 1. Navigate to Audit Logs: [Audit Logs Console](https://console.cloud.google.com/iam-admin/audit). 2. Follow the [Data Access Logging Configuration Guide](https://cloud.google.com/logging/docs/audit/configure-data-access) to enable logs for all services. 3. Ensure no exemptions are configured. #### Using Google Cloud CLI: Export the current IAM policy to a file: gcloud projects get-iam-policy /tmp/project\_policy.yaml For folders or organizations: gcloud organizations get-iam-policy /tmp/org\_policy.yaml gcloud resource-manager folders get-iam-policy /tmp/folder\_policy.yaml Edit the policy file to include: auditConfigs: - auditLogConfigs: - logType: DATA\_WRITE - logType: DATA\_READ service: allServices 1. Ensure no exemptedMembers are listed. Update the policy: gcloud projects set-iam-policy PROJECT\_ID /tmp/project\_policy.yaml gcloud organizations set-iam-policy ORGANIZATION\_ID /tmp/org\_policy.yaml gcloud resource-manager folders set-iam-policy FOLDER\_ID /tmp/folder\_policy.yaml ## **Backout Plan:** ### 1\. Restore Previous IAM Policy (If Needed) ### If the audit logging configuration breaks workflows, restore the previous IAM policy: gcloud projects set-iam-policy policy-backup.json ### 2\. Adjust Logging Settings Based on Usage - ### Enable only necessary logs to balance cost vs. security. ### References: 1. [Cloud Audit Logging Overview](https://cloud.google.com/logging/docs/audit/) 2. [Configuring Data Access Logs](https://cloud.google.com/logging/docs/audit/configure-data-access) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Ensure audit logs are collected across all enterprise systems for monitoring.

✅

✅

✅

8.11 Conduct Audit Log Reviews

Regularly review audit logs to detect anomalies and potential threats.

✅

✅

❌

6.2 Activate Audit Logging

Enable logging on all systems and networking devices.

✅

✅

✅

## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.