Google CloudOverview
Centralized logging helps ensure forensic and audit evidence is retained even if project-level settings change.
Remediation guidance
Google Cloud Remediation
Service-Wide (Recommended)
Configure aggregated sinks at org/folder scope that include children and route audit/security logs centrally.
Google Cloud Console (Asset-Level)
- Open Cloud Logging Logs Router at org/folder scope.
- Create sink with Include children enabled.
- Route logs to centralized project, bucket, or SIEM destination.
Google Cloud CLI (Service-Wide)
gcloud logging sinks create <sink-name> <destination> --organization=<org-id> --include-children --log-filter="<filter>"
References
- https://cloud.google.com/logging/docs/export/configure_export_v2
Query logic
These are the stored checks tied to this control.
Missing aggregated log sinks
Connectors
Google Cloud
Covered asset types
LogSink
Expected check: eq []
{ logSinks(where: { OR: [ { includeChildren: false }, { destination: "" } ] }) { ...AssetFragment } }
