HTTP(S) load balancer has logging enabled

Check ID: compute_loadbalancer_logging_enabled
Provider: GCP
Service: compute
Severity: HIGH
Categories: logging
Resource type: compute.googleapis.com/BackendService

What this check verifies

Application Load Balancer (HTTP/S) backend services have Cloud Logging for requests enabled at the backend service level. Only load balancers with a backend service support this setting.

Risk

Without request logs, visibility into HTTP(S) traffic is reduced, hindering detection of credential stuffing, path traversal, WAF bypass, and data exfiltration. This impacts confidentiality and integrity, and delays incident response; availability issues (surges in 5xx) may go unnoticed.

Recommendation

Enable request logging on backend services with a risk-appropriate sampleRate; include key optional fields when needed. Export logs to monitoring for alerts and dashboards, enforce retention and integrity controls, and restrict access using least privilege and defense in depth.

Remediation

CLI
Terraform
Dashboard steps

gcloud compute backend-services update <example_resource_name> —global —enable-logging

resource "google_compute_backend_service" "<example_resource_name>" {
  name          = "<example_resource_name>"
  health_checks = ["<example_health_check_self_link>"]

  log_config {
    enable = true # Critical: enables logging on the backend service
  }
}

References

Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = compute_loadbalancer_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to GCP checks

Suspended VM instance has no persistent disks attached Project does not have a default VPC network

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires