Description

Ensure that Data Access audit logs are enabled for the Cloud Storage API so that read and write operations on object data (in addition to administrative activity) are recorded in Cloud Audit Logs.

Rationale

By default, Admin Activity audit logs are always enabled and capture configuration changes, but Data Access audit logs, which record who read or wrote which objects, are not enabled by default because of their potential volume. Without Data Access logs, investigators cannot determine who accessed or exfiltrated specific objects in a bucket, which significantly limits incident response and forensic capability for data stored in Cloud Storage.

Impact

  • Provides visibility into who read, wrote, or deleted specific objects in Cloud Storage buckets

  • Improves incident response and forensic investigation capability for data access events

  • Supports compliance requirements for auditing access to sensitive data

  • Increases log volume and associated Cloud Logging storage cost

Default Value

Data Access audit logs for Cloud Storage are disabled by default, except for the DATA_WRITE log type for BigQuery, which is unrelated to this control.

Pre-Requisites

  • IAM permissions to view and edit IAM Audit Config (e.g., Project IAM Admin or Organization Policy Administrator)

  • Awareness of the additional logging cost from enabling Data Access logs

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to IAM & Admin > Audit Logs.

  4. Locate Google Cloud Storage in the list of services.

  5. Verify that Admin Read, Data Read, and Data Write log types are all enabled (checked).

  6. If any Data Access log type is disabled for Cloud Storage, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to IAM & Admin > Audit Logs.

  4. Locate Google Cloud Storage in the service list and select it.

  5. In the panel that appears, check Admin Read, Data Read, and Data Write.

  6. Click Save.

  7. Optionally configure exempted members if certain service accounts should be excluded from Data Access logging to control log volume.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to IAM & Admin > Audit Logs.

  4. Locate Google Cloud Storage and select it.

  5. Uncheck Data Read and/or Data Write as needed (Admin Activity logs cannot be disabled).

  6. Click Save.

Reference