# 2.10 Ensure Log Metric Filter and Alerts Exist for Cloud Storage IAM Permission Changes (Automated) - Source: https://support.icompaas.com/support/solutions/articles/62000232977-2-10-ensure-log-metric-filter-and-alerts-exist-for-cloud-storage-iam-permission-changes-automated- - Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178) - Last updated: 2026-05-29 - Publisher: iCompaas, Inc. (https://www.icompaas.com) ### Profile Applicability: Level 2 ### Description: To monitor changes to Cloud Storage bucket IAM permissions, a log metric filter and associated alert policy should be configured. This ensures quick detection of unauthorized or unintended permission changes that could impact sensitive data stored in Cloud Storage. ### Rationale: Changes to Cloud Storage bucket permissions can expose sensitive data or compromise access control. By setting up log metrics and alerts, organizations can detect and respond to IAM permission modifications promptly, minimizing potential risks. ### Impact: Enabling logging may incur additional costs for log storage and processing, especially for organizations with frequent permission changes. ### Default Value: By default, there are no log metrics or alert policies configured for monitoring IAM permission changes on Cloud Storage buckets. ### Audit Steps: #### Using Google Cloud Console: 1. Verify Log Metric Configuration: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                        ![](https://support.icompaas.com/assets/kb/dad212f43e41bd34.png) - Under User-defined Metrics, ensure a metric exists with the filter: resource.type="gcs\_bucket" AND protoPayload.methodName="storage.setIamPermissions" 2. Verify Alert Policy Configuration: - Navigate to [Alerting](https://console.cloud.google.com/monitoring/alerting).                          ![](https://support.icompaas.com/assets/kb/35c3574a02219e00.png) - Confirm an alert policy is linked to the above metric with: - Condition: Triggers on any IAM permission change. - Threshold: 0 (alerts for every change).                                    ![](https://support.icompaas.com/assets/kb/d843912329f4623c.png) - Ensure appropriate notification channels are configured.                               ![](https://support.icompaas.com/assets/kb/1449fa8599a3c576.png) #### Using Google Cloud CLI: 1. Verify Log Metric Configuration: - List all log metrics: gcloud logging metrics list --format json - Check for a metric with the following filter: resource.type="gcs\_bucket" AND protoPayload.methodName="storage.setIamPermissions" 2. Verify Alert Policy Configuration: - List alerting policies: gcloud alpha monitoring policies list --format json - Ensure an alert policy exists with: - Condition Filter: Matches the above metric. - Enabled: true. ### Remediation Steps: #### Using Google Cloud Console: 1. Create a Log Metric: - Navigate to [Logs-based Metrics](https://console.cloud.google.com/logs/metrics).                               ![](https://support.icompaas.com/assets/kb/fc5556b54417f41e.png) - Click CREATE METRIC and configure:                               ![](https://support.icompaas.com/assets/kb/16baa17982d3c09d.png) Filter: resource.type="gcs\_bucket" AND protoPayload.methodName="storage.setIamPermissions" - Type: Counter. - Units: 1 (default).                                    ![](https://support.icompaas.com/assets/kb/201b08423cbbf9b0.png) - Click Create Metric.                                        ![](https://support.icompaas.com/assets/kb/186fa9e9436487f7.png) 2. Create an Alert Policy: - Locate the newly created metric under User-defined Metrics.                              ![](https://support.icompaas.com/assets/kb/97a88e45d705a00c.png) - Click the three-dot menu and select Create alert from Metric![](https://support.icompaas.com/assets/kb/0f2def2fa244096c.png) - Configure the alert: - Aggregator: Count. - Threshold: Above 0. - Condition: Trigger alerts for any IAM permission change. - Configure notification channels and save the policy.                          ![](https://support.icompaas.com/assets/kb/08a0fccb226646d7.png) #### Using Google Cloud CLI: Create a Log Metric: gcloud logging metrics create \\ --description="Monitor Cloud Storage IAM permission changes" \\ --log-filter="resource.type='gcs\_bucket' AND protoPayload.methodName='storage.setIamPermissions'" Create an Alert Policy: gcloud alpha monitoring policies create \\ --display-name="" \\ --conditions="" \\ --notification-channels="" ### References: 1. [Logs-Based Metrics](https://cloud.google.com/logging/docs/logs-based-metrics) 2. [Custom Metrics in Monitoring](https://cloud.google.com/monitoring/custom-metrics/) 3. [Alerts in Monitoring](https://cloud.google.com/monitoring/alerts/) 4. [Logging CLI Reference](https://cloud.google.com/logging/docs/reference/tools/gcloud-logging) 5. [Cloud Storage Overview](https://cloud.google.com/storage/docs/overview) 6. [IAM Roles in Cloud Storage](https://cloud.google.com/storage/docs/access-control/iam-roles) ### CIS Controls:

Control

Description

IG 1

IG 2

IG 3

8.2 Collect Audit Logs

Enable audit logging across enterprise assets.

✅

✅

✅

8.5 Collect Detailed Audit Logs

Capture detailed logs to include timestamps, source/destination, and user actions.

✅

✅


6.2 Activate Audit Logging

Ensure local logging is enabled on systems and devices.

✅

✅

✅

6.3 Enable Detailed Logging

Include event source, user details, and timestamp in logs.

✅

✅


## Related compliance guidance - [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them. - [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.