Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging

中级别 1人工审核gcp

说明

Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console. Enabling the "Sharing of data with Google Cloud Services" setting allows these logs to flow into the Google Cloud (GCP) Organization’s Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation. Without centralized logging of identity provider events, security teams cannot easily correlate Workspace/Identity administrative changes with GCP resource changes. If a Super Admin account is compromised, the audit trail must be preserved in a secure, centralized location to prevent an attacker from deleting evidence within the Wor...

检查方式

审计方法: 人工审核

此项建议无法自动检查。当您传入 --include-manual 时，扫描结果会列出该项并附带这些说明。

修复方式

修复方法: 操作指南或基础设施补丁

1. Log in to the Google Admin Console as a Super Admin. 2. From the Home page, go to Account > Account settings. 3. Click on the Legal and compliance section. 4. Locate the setting titled Sharing options - Google Cloud Platform Sharing Options. o Click on Enabled o Click on Save 5. (Optional but Recommended) Navigate to the GCP Console > Logging > Logs Explorer and verify that the logs are arriving from the admin portal.

属性

操作系统: 任意
标签: cloudgcplogging
参考: CIS Google Cloud Platform Foundation Benchmark v5.0.0 - 2.2 Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging