Check ID:
Provider: GCP
Service:
Severity: MEDIUM
Categories:
Resource type:
logging_sink_createdProvider: GCP
Service:
loggingSeverity: MEDIUM
Categories:
logging, forensics-readyResource type:
logging.googleapis.com/LogSinkWhat this check verifies
Cloud Logging project contains at least one sink that exports a copy of all log entries to a destination for centralized retention or processingRisk
Without exporting all logs, audit evidence can expire or be altered in-project, reducing the availability and integrity of telemetry. This hinders threat detection and forensics, prevents cross-project correlation, and can let attacker actions evade scrutiny after log rotation or deletion.Recommendation
Create a centralized export sink that routes all logs to a secured, durable, preferably immutable destination with extended retention. Apply least privilege to sink identities, separate duties by isolating destinations, use defense in depth (encryption, access controls), and monitor sink health for continuity.Remediation
- CLI
- Terraform
- Dashboard steps
gcloud logging sinks create <example_resource_name> logging.googleapis.com/projects/<example_resource_id>
References
- https://www.trendmicro.com/trendaivisiononecloudriskmanagement/knowledge-base/gcp/CloudLogging/export-all-log-entries.html
- https://cloud.google.com/logging/docs/export
Where this check fires
This check runs on every scheduled scan against your GCP account. Findings appear at Cloud Security → Findings filterable byCheck ID = logging_sink_created. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to GCP checks