Cloud Storage buckets have Usage and Storage Logs enabled

Check ID: cloudstorage_bucket_logging_enabled
Provider: GCP
Service: cloudstorage
Severity: MEDIUM
Categories: logging
Resource type: storage.googleapis.com/Bucket

What this check verifies

Google Cloud Storage buckets are evaluated to ensure that Usage and Storage Logs are enabled. Enabling these logs provides detailed visibility into access requests, usage patterns, and storage activity within each bucket.

Risk

Buckets without Usage and Storage Logs enabled lack visibility into access and storage activity, which increases the risk of undetected data exfiltration, misuse, or configuration errors.

Recommendation

Enable Usage and Storage Logs for all Cloud Storage buckets to track access, detect anomalies, and maintain audit visibility of data operations.

Remediation

CLI
Terraform

gsutil logging set on -b gs://<LOGGING_BUCKET> -o <LOG_OBJECT_PREFIX> gs://<BUCKET_NAME>

# Example: enable Usage and Storage Logs on a Cloud Storage bucket
resource "google_storage_bucket" "example" {
  name     = var.bucket_name
  location = var.location

  logging {
    log_bucket        = var.log_bucket_name
    log_object_prefix = "${var.bucket_name}/"
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = cloudstorage_bucket_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Cloud Storage log bucket has a locked retention policy Cloud Storage bucket is not publicly accessible

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires