# 2.6 Ensure Log Metric Filter and Alerts Exist for Custom Role Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232960-26-ensure-log-metric-filter-and-alerts-exist-for-custom-role-changes-automated - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-06-16 - Publisher: iCompaas, Inc. (https://www.icompaas.com) Profile Applicability:Level 1 ### Description: It is recommended to configure a log metric filter and alert to monitor changes related to Identity and Access Management (IAM) custom roles, including creation, deletion, and updates. Monitoring these changes ensures proper tracking of custom role configurations and minimizes the risk of over-privileged roles being created or modified without oversight. ### Rationale: IAM provides predefined roles for granular access control. However, custom roles can be created to meet specific organizational needs. Monitoring the creation, deletion, or updates of custom roles is crucial to: - Prevent unauthorized modifications. - Detect over-privileged roles early. - Ensure adherence to the principle of least privilege. ### Impact: Enabling logging may result in increased costs for storing and analyzing log data. ### Default Value: IAM custom role changes are not monitored by default. ### Audit Steps: #### Using Google Cloud Console: 1. Verify Log Metric Configuration: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics). ![](https://support.icompaas.com/assets/kb/c1b1c91f26bc9a9c.png) - In the User-defined Metrics section, ensure a metric exists with the filter: resource.type="iam\_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole") 2. Verify Alerting Policy Configuration: - **Go to [Alerting](https://console.cloud.google.com/monitoring/alerting).**                               **![](https://support.icompaas.com/assets/kb/8f231ab35c1bc80a.png)** - **Confirm there is at least one alert policy for the above metric.** - **Check that the alert condition is configured to trigger when:** - **Threshold: Any value above 0 for custom role changes.** - **Notifications: Appropriate notification channels are configured.** #### **Using Google Cloud CLI:** 1. **Verify Log Metric Configuration:** - List log metrics: gcloud logging metrics list --format json - Check for a metric with the filter: resource.type="iam\_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole") 2. Verify Alerting Policy Configuration: - List alerting policies: gcloud alpha monitoring policies list --format json - **Ensure the output contains a policy where:** - **Condition Filter: Matches the above metric.** - **Enabled: true.** ### **Remediation Steps:** #### **Using Google Cloud Console:** 1. **Create a Log Metric:** - **Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).**                             **![](https://support.icompaas.com/assets/kb/9b998635cb58351a.png)** - Click CREATE METRIC and set:                             **![](https://support.icompaas.com/assets/kb/d431ac4065555ac8.png)** **Filter:** resource.type="iam\_role" AND (protoPayload.methodName="google.iam.admin.v1.CreateRole" OR protoPayload.methodName="google.iam.admin.v1.DeleteRole" OR protoPayload.methodName="google.iam.admin.v1.UpdateRole") - **Metric Type: Counter** - **Units: 1 (default)**                          **![](https://support.icompaas.com/assets/kb/bb64b0615a1e8e51.png)** - Click Create Metric.                             **![](https://support.icompaas.com/assets/kb/7c934eac220657b2.png)** 2. Create an Alert Policy: - Locate the created metric under User-defined Metrics.                           **![](https://support.icompaas.com/assets/kb/6b449863fe780e62.png)** - Click the three-dot menu and select Create alert from Metric.                                  **![](https://support.icompaas.com/assets/kb/11dbdba86427c341.png)** - **Configure:** - Aggregator: Count - Threshold: Above 0. - Condition: Any change triggers the ale**rt.** - **Configure notification channels and save the policy.** #### **Using Google Cloud CLI:** Create a Log Metric: gcloud logging metrics create \\ --description="Monitor IAM custom role changes" \\ --log-filter="resource.type='iam\_role' AND \\ (protoPayload.methodName='google.iam.admin.v1.CreateRole' OR \\ protoPayload.methodName='google.iam.admin.v1.DeleteRole' OR \\ protoPayload.methodName='google.iam.admin.v1.UpdateRole')" Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### References: 1. [Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics/) 2. [Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics/) 3. [Alerts in Monitoring](https://cloud.google.com/monitoring/alerts/) 4. [IAM Custom Roles](https://cloud.google.com/iam/docs/understanding-custom-roles) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Enable detailed logs for sensitive data, including event source and timestamps.

✅

✅


6.2 Activate Audit Logging

Ensure audit logging is enabled on all systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include detailed information such as event source, date, user, and timestamps.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.