TMA-GCP-2.2

Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging

中レベル 1手動レビューgcp

説明

Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console. Enabling the "Sharing of data with Google Cloud Services" setting allows these logs to flow into the Google Cloud (GCP) Organization’s Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation. Without centralized logging of identity provider events, security teams cannot easily correlate Workspace/Identity administrative changes with GCP resource changes. If a Super Admin account is compromised, the audit trail must be preserved in a secure, centralized location to prevent an attacker from deleting evidence within the Wor...

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Log in to the Google Admin Console as a Super Admin. 2. From the Home page, go to Account > Account settings. 3. Click on the Legal and compliance section. 4. Locate the setting titled Sharing options - Google Cloud Platform Sharing Options. o Click on Enabled o Click on Save 5. (Optional but Recommended) Navigate to the GCP Console > Logging > Logs Explorer and verify that the logs are arriving from the admin portal.

プロパティ

オペレーティングシステム: すべて
タグ: cloudgcplogging
参照: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 2.2 Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging