# Ensure Cloud Storage Buckets Have Usage and Storage Logs Enabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1788888292204703-ensure-cloud-storage-buckets-have-usage-and-storage-logs-enabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [GCP Benchmarks](https://support.icompaas.com/support/solutions/62000112667) › [GCP Knowledge Bases](https://support.icompaas.com/support/solutions/folders/62000169178)
- Last updated: 2026-09-08
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure that Cloud Storage buckets are configured to record usage logs (request-level access logs) and storage logs (daily storage metrics) so that bucket activity and storage consumption are logged for monitoring and audit purposes.

**Rationale**

Usage and storage logs provide a historical record of requests made against a bucket and its daily storage usage, which supports capacity planning, cost analysis, and security investigations. Without these logs enabled, organizations lack visibility into request patterns and cannot retroactively analyze bucket access trends outside of what Cloud Audit Logs capture.

**Impact**

-   Provides historical visibility into request patterns and storage consumption for a bucket
    
-   Supports capacity planning, cost analysis, and security investigations
    
-   Requires a separate destination (logging) bucket and results in additional stored log objects and cost
    

**Default Value**

By default, Cloud Storage usage and storage logging is disabled for newly created buckets and must be configured manually.

**Pre-Requisites**

-   A dedicated Cloud Storage bucket configured to receive the usage and storage log objects
    
-   The Cloud Storage system account granted Storage Object Creator (or equivalent) permission on the logging bucket
    
-   IAM permissions to configure bucket logging (e.g., Storage Admin)
    

**Test Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Select the relevant project.
    
3.  Navigate to Cloud Storage > Buckets and select the bucket to review.
    
4.  Open the Configuration tab and review the Logs section.
    
5.  Verify that a log bucket and log object prefix are configured for usage and storage logs.
    
6.  Confirm log objects are being written to the destination logging bucket.
    
7.  If logging is not configured, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Navigate to Cloud Storage > Buckets and create (or identify) a dedicated bucket to hold usage and storage logs.
    
3.  Grant the Cloud Storage system account the Storage Object Creator role on the logging bucket.
    
4.  Select the source bucket to configure, open the Configuration tab, and locate the Logs section.
    
5.  Select Edit and enable usage logs and storage logs, specifying the destination logging bucket and an optional log object prefix.
    
6.  Click Save.
    
7.  Confirm that usage\_\* and storage\_\* log objects begin appearing in the destination bucket.
    

**Backout Plan**

1.  Sign in to the Google Cloud Console at [https://console.cloud.google.com](https://console.cloud.google.com/).
    
2.  Navigate to Cloud Storage > Buckets and select the source bucket.
    
3.  Open the Configuration tab and locate the Logs section.
    
4.  Select Edit and disable usage and storage logging.
    
5.  Click Save.
    

**Reference**

-   [https://cloud.google.com/storage/docs/access-logs](https://cloud.google.com/storage/docs/access-logs)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.