Check ID: iam_audit_logs_enabled
Provider: GCP
Service: iam
Severity: MEDIUM
Categories: logging, forensics-ready
Resource type: cloudresourcemanager.googleapis.com/Project

​
What this check verifies

GCP project has Cloud Audit Logs configured to capture administrative operations and data access events for services and principals (per IAM Audit Logs, including ADMIN_READ, DATA_READ, DATA_WRITE).

​
Risk

Absent or partial audit logging reduces visibility into who accessed data or changed configurations, hindering detection and forensics. Misused identities can alter IAM to persist access, exfiltrate data, or delete resources, impacting confidentiality, integrity, and availability.

​
Recommendation

Enable comprehensive Cloud Audit Logs for all services and principals, including ADMIN_READ, DATA_READ, DATA_WRITE. Avoid exemptions. Set org/folder defaults, centralize and retain logs, enforce least privilege on log access, protect logs from alteration, and alert on anomalous access.

​
Remediation

# Enable Cloud Audit Logs (Data Access) for all services
resource "google_project_iam_audit_config" "all" {
  project = "<example_resource_id>"
  service = "allServices" # Critical: apply to all services

  # Critical: enable Data Access audit log types to pass the check
  audit_log_config { log_type = "ADMIN_READ" }  # metadata/config reads
  audit_log_config { log_type = "DATA_READ" }   # data reads
  audit_log_config { log_type = "DATA_WRITE" }  # data writes
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable by Check ID = iam_audit_logs_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks