Description

Ensure that Cloud Storage buckets are configured to record usage logs (request-level access logs) and storage logs (daily storage metrics) so that bucket activity and storage consumption are logged for monitoring and audit purposes.

Rationale

Usage and storage logs provide a historical record of requests made against a bucket and its daily storage usage, which supports capacity planning, cost analysis, and security investigations. Without these logs enabled, organizations lack visibility into request patterns and cannot retroactively analyze bucket access trends outside of what Cloud Audit Logs capture.

Impact

  • Provides historical visibility into request patterns and storage consumption for a bucket

  • Supports capacity planning, cost analysis, and security investigations

  • Requires a separate destination (logging) bucket and results in additional stored log objects and cost

Default Value

By default, Cloud Storage usage and storage logging is disabled for newly created buckets and must be configured manually.

Pre-Requisites

  • A dedicated Cloud Storage bucket configured to receive the usage and storage log objects

  • The Cloud Storage system account granted Storage Object Creator (or equivalent) permission on the logging bucket

  • IAM permissions to configure bucket logging (e.g., Storage Admin)

Test Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Select the relevant project.

  3. Navigate to Cloud Storage > Buckets and select the bucket to review.

  4. Open the Configuration tab and review the Logs section.

  5. Verify that a log bucket and log object prefix are configured for usage and storage logs.

  6. Confirm log objects are being written to the destination logging bucket.

  7. If logging is not configured, follow the implementation steps.

Implementation Steps

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Cloud Storage > Buckets and create (or identify) a dedicated bucket to hold usage and storage logs.

  3. Grant the Cloud Storage system account the Storage Object Creator role on the logging bucket.

  4. Select the source bucket to configure, open the Configuration tab, and locate the Logs section.

  5. Select Edit and enable usage logs and storage logs, specifying the destination logging bucket and an optional log object prefix.

  6. Click Save.

  7. Confirm that usage_* and storage_* log objects begin appearing in the destination bucket.

Backout Plan

  1. Sign in to the Google Cloud Console at https://console.cloud.google.com.

  2. Navigate to Cloud Storage > Buckets and select the source bucket.

  3. Open the Configuration tab and locate the Logs section.

  4. Select Edit and disable usage and storage logging.

  5. Click Save.

Reference