Google CloudOverview
Description It is recommended to enable object versioning on log-buckets.
Rationale
Logs can be exported by creating one or more sinks that include a logs filter and a destination. As Stackdriver Logging receives new log entries, they are compared against each sink. If a log entry matches a sink's filter, then a copy of the log entry is written to the destination.
Sinks can be configured to export logs in Storage buckets. To support the retrieval of objects that are deleted or overwritten, Object Versioning feature should be enabled on all such storage buckets where sinks are configured.
Remediation guidance
Using Command-Line
- To list all sinks destined to storage buckets:
gcloud logging sinks list | grep storage.googleapis.com
- For every storage bucket listed above, verify that Object Versioning is Enabled:
gsutil versioning set on gs://
**Impact**
None
**Default Value**
By Default Object Versioning is in Suspended state for a storage bucket.
**References**
1. https://cloud.google.com/storage/docs/object-versioning
### Google Cloud Console (Asset-Level)
1. Open the affected project/resource from the finding details in Google Cloud Console.
2. Navigate to the resource security/configuration settings.
3. Apply the control-specific secure configuration.
4. Save and re-run the check.
## Service-wide remediation
> **Recommended when many resources are affected:** fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.
### Google Cloud
Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.
## Operational rollout
1. Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
2. Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
3. Re-scan and track approved exceptions with an owner and expiry date.
Query logic
These are the stored checks tied to this control.
Object versioning is enabled on log-buckets
Connectors
Google Cloud
Covered asset types
Bucket
Expected check: eq []
GCPLogging3{...AssetFragment}
