TMA-GCP-2.2
Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging
Descrição
Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console. Enabling the "Sharing of data with Google Cloud Services" setting allows these logs to flow into the Google Cloud (GCP) Organization’s Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation. Without centralized logging of identity provider events, security teams cannot easily correlate Workspace/Identity administrative changes with GCP resource changes. If a Super Admin account is compromised, the audit trail must be preserved in a secure, centralized location to prevent an attacker from deleting evidence within the Wor...
Como é verificado
Método de auditoria: Revisão manual
Esta recomendação não pode ser verificada automaticamente. Uma varredura a lista com estas instruções quando você passa --include-manual.
1. Log in to the Google Admin Console as a Super Admin. 2. From the Home page, go to Account > Account settings. 3. Click on the Legal and compliance section. 4. Locate the setting titled Sharing options - Google Cloud Platform Sharing Options. o Verify that the status is set to Enabled.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
1. Log in to the Google Admin Console as a Super Admin. 2. From the Home page, go to Account > Account settings. 3. Click on the Legal and compliance section. 4. Locate the setting titled Sharing options - Google Cloud Platform Sharing Options. o Click on Enabled o Click on Save 5. (Optional but Recommended) Navigate to the GCP Console > Logging > Logs Explorer and verify that the logs are arriving from the admin portal.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- cloudgcplogging
- Referência
- CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 2.2 Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging