Google CloudOverview
Description It is recommended to enable object versioning on log-buckets.
Rationale
Logs can be exported by creating one or more sinks that include a logs filter and a destination. As Stackdriver Logging receives new log entries, they are compared against each sink. If a log entry matches a sink's filter, then a copy of the log entry is written to the destination.
Sinks can be configured to export logs in Storage buckets. To support the retrieval of objects that are deleted or overwritten, Object Versioning feature should be enabled on all such storage buckets where sinks are configured.
Remediation guidance
Using Command-Line
- To list all sinks destined to storage buckets:
gcloud logging sinks list | grep storage.googleapis.com
- For every storage bucket listed above, verify that Object Versioning is Enabled:
gsutil versioning set on gs://
**Impact**
None
**Default Value**
By Default Object Versioning is in Suspended state for a storage bucket.
**References**
1. https://cloud.google.com/storage/docs/object-versioning
### Google Cloud Console (Asset-Level)
1. Open the affected project/resource from the finding details in Google Cloud Console.
2. Navigate to the resource security/configuration settings.
3. Apply the control-specific secure configuration.
4. Save and re-run the check.
## Multiple Remediation Paths
### Google Cloud
**SERVICE-WIDE (RECOMMENDED when many resources are affected):**
Enforce Organization Policies at org/folder level so new resources inherit secure defaults.
~~~bash
gcloud org-policies set-policy policy.yaml
~~~
**ASSET-LEVEL:**
Use the product-specific remediation steps above for only the impacted project/resources.
**PREVENTIVE:**
Use org policy constraints/custom constraints and enforce checks in deployment pipelines.
### References for Service-Wide Patterns
- GCP Organization Policy overview: https://cloud.google.com/resource-manager/docs/organization-policy/overview
- GCP Organization policy constraints catalog: https://cloud.google.com/resource-manager/docs/organization-policy/org-policy-constraints
- gcloud org-policies: https://cloud.google.com/sdk/gcloud/reference/org-policies
## Operational Rollout Workflow
Use this sequence to reduce risk and avoid repeated drift.
### 1. Contain at Service-Wide Scope First (Recommended)
- Google Cloud: apply organization policy constraints at org/folder scope.
~~~bash
gcloud org-policies set-policy policy.yaml
~~~
### 2. Remediate Existing Affected Assets
- Execute the control-specific Console/CLI steps documented above for each flagged resource.
- Prioritize internet-exposed and production assets first.
### 3. Validate and Prevent Recurrence
- Re-scan after each remediation batch.
- Track exceptions with owner and expiry date.
- Add preventive checks in IaC/CI pipelines.
Query logic
These are the stored checks tied to this control.
Object versioning is enabled on log-buckets
Connectors
Google Cloud
Covered asset types
Bucket
Expected check: eq []
GCPLogging3{...AssetFragment}
