Google CloudOverview
Logging enabled on a HTTPS Load Balancer will show all network traffic and its destination.
Rationale
Logging will allow you to view HTTPS network traffic to your web applications.
Impact
On high use systems with a high percentage sample rate, the logging file may grow to high capacity in a short amount of time. Ensure that the sample rate is set appropriately so that storage costs are not exorbitant.
Remediation guidance
Remediation
From Console
- From Google Cloud home open the Navigation Menu in the top left.
- Under the
Networkingheading selectNetwork services. - Select the HTTPS load-balancer you wish to audit.
- Select
EditthenBackend Configuration. - Select
Editon the corresponding backend service. - Click
Enable Logging. - Set
Sample Rateto a desired value. This is a percentage as a decimal point. 1.0 is 100%.
From Command Line
- Run the following command
gcloud compute backend-services update <serviceName> --region=REGION --enable-logging --logging-sample-rate=<percentageAsADecimal>
Default Value
By default logging for https load balancing is disabled. When logging is enabled it sets the default sample rate as 1.0 or 100%. Ensure this value fits the need of your organization to avoid high storage costs.
Service-wide remediation
Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
Google Cloud
Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.
Operational rollout
- Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
- Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
- Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Google Cloud Load Balancers without logging
Connectors
Covered asset types
Expected check: eq []
{
loadBalancers(
where: { backendServices_ALL: { NOT: { logConfigEnabled: true } } }
) {
...AssetFragment
}
}
