TMA-GCP-2.2

Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging

보통레벨 1수동 검토gcp

설명

Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console. Enabling the "Sharing of data with Google Cloud Services" setting allows these logs to flow into the Google Cloud (GCP) Organization’s Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation. Without centralized logging of identity provider events, security teams cannot easily correlate Workspace/Identity administrative changes with GCP resource changes. If a Super Admin account is compromised, the audit trail must be preserved in a secure, centralized location to prevent an attacker from deleting evidence within the Wor...

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Log in to the Google Admin Console as a Super Admin. 2. From the Home page, go to Account > Account settings. 3. Click on the Legal and compliance section. 4. Locate the setting titled Sharing options - Google Cloud Platform Sharing Options. o Click on Enabled o Click on Save 5. (Optional but Recommended) Navigate to the GCP Console > Logging > Logs Explorer and verify that the logs are arriving from the admin portal.

속성

운영 체제: 모두
태그: cloudgcplogging
참고 자료: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 2.2 Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging