Skip to content

Google Cloud logging & audit security checks

Audit logs, event retention and incident-response hooks — the evidence you need when something goes wrong, and the controls auditors ask for first.

On Google Cloud, Black Cat runs 9 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Google Cloud connector needs.

Checks (9)

severity: high Audit Logging Not Enabled fix difficulty: easy #

Enable Admin Read, Data Read, and Data Write audit logs for GCP services

  1. Navigate to GCP Console > IAM & Admin > Audit Logs
  2. Select the services that need audit logging enabled
  3. Enable Admin Read, Data Read, and Data Write log types
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC4.1 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 GDPR (SaaS Security) GDPR-33.1 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium Data Access Logs Incomplete fix difficulty: easy #

Enable all data access log types (DATA_READ, DATA_WRITE) for GCP services with incomplete logging

  1. Navigate to GCP Console > IAM & Admin > Audit Logs
  2. Identify services with incomplete data access log types
  3. Enable all data access log types (DATA_READ, DATA_WRITE) for each service
  4. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.27 SOC 2 Type II CC4.1 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high Subnet Flow Logs Disabled fix difficulty: easy #

Enable VPC flow logs on all subnetworks to capture network traffic metadata for security monitoring (CIS GCP 3.8)

  1. Navigate to GCP Console > VPC Network > VPC Networks
  2. Select the flagged subnetwork and click Edit
  3. Under Flow logs, select On
  4. Configure aggregation interval and sample rate as appropriate
  5. Save changes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-32.1d HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium PostgreSQL log_connections Not Enabled fix difficulty: easy #

Set the log_connections database flag to on to log all connection attempts (CIS GCP 6.2.2)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Add or update log_connections to on
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium PostgreSQL log_disconnections Not Enabled fix difficulty: easy #

Set the log_disconnections database flag to on to log all session disconnections (CIS GCP 6.2.3)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Add or update log_disconnections to on
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low PostgreSQL log_min_messages Below WARNING fix difficulty: easy #

Set log_min_messages to WARNING or a more severe level (CIS GCP 6.2.5)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Set log_min_messages to WARNING
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low PostgreSQL log_min_error_statement Above ERROR fix difficulty: easy #

Set log_min_error_statement to ERROR or a more severe level (CIS GCP 6.2.6)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Set log_min_error_statement to ERROR
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: low PostgreSQL log_min_duration_statement Not Disabled fix difficulty: easy #

Set log_min_duration_statement to -1 to disable duration-based statement logging and avoid logging sensitive data (CIS GCP 6.2.7)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Set log_min_duration_statement to -1
  4. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: medium PostgreSQL pgaudit Extension Not Enabled fix difficulty: medium #

Enable the pgaudit extension for detailed audit logging (CIS GCP 6.2.8)

  1. Navigate to GCP Console > SQL > Instances and select the PostgreSQL instance
  2. Click Edit, then open the Flags section
  3. Set cloudsql.enable_pgaudit to on
  4. Configure pgaudit.log to specify which statement classes to audit
  5. Save and confirm the restart

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.15 SOC 2 Type II CC7.2 CIS Controls v8 CIS-06.2 NIST CSF 2.0 DE.CM NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

More Google Cloud checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial