Ensure log metric filter and alerts exist for VPC network route changes

From Google Cloud Console

Create the Log Metric

1. Go to Logging, Log-based Metrics by visiting https://console.cloud.google.com/logs/metrics
2. Select Create metric
3. For Metric Type, select Counter
4. Under Details, add a name and set the Units to 1
5. Under Filter selection, add the following query:

resource.type="gce_route"
AND (protoPayload.methodName:"compute.routes.delete"
OR protoPayload.methodName:"compute.routes.insert")

1. Click Create Metric

Create the alert policy

1. Go back to Log-based Metrics and identify the newly created metric under User-defined metrics
2. Click the 3-dot icon in rightmost column of that metric to open menu options and select Create alert from Metric
3. Fill in the required details. Choose the alerting threshold and configuration that makes sense for the organization. For example, a threshold of zero(0) for the most recent value ensures that a notification is triggered for every owner change in the project:

Set `Aggregator` to `Count`
Set `Configuration`:
- Condition: above
- Threshold: 0
- For: most recent value

1. Under Configure notifications, configure the desired notification channels
2. Name the policy and select CREATE POLICY

Using Google Cloud CLI

Create the Log Metric

• Use command: gcloud logging metrics create
• Reference for Command Usage: https://docs.cloud.google.com/sdk/gcloud/reference/logging/metrics/create

Create the Alert Policy

• Use command: gcloud monitoring policies create
• Reference for command Usage: https://docs.cloud.google.com/sdk/gcloud/reference/monitoring/policies/create

References

1. https://cloud.google.com/logging/docs/logs-based-metrics/
2. https://cloud.google.com/monitoring/custom-metrics/
3. https://cloud.google.com/monitoring/alerts/
4. https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
5. https://cloud.google.com/storage/docs/access-control/iam
6. https://docs.cloud.google.com/sdk/gcloud/reference/logging/metrics/create
7. https://docs.cloud.google.com/sdk/gcloud/reference/monitoring/policies/create

Service-wide remediation

Recommended when many resources are affected: fix the platform baseline first so new resources inherit the secure setting, then remediate the existing flagged resources in batches.

Google Cloud

Use organization or folder policies where available, shared project templates, logs and alerting baselines, and IaC modules so new resources inherit the secure setting.

Operational rollout

1. Fix the baseline first at the account, subscription, project, cluster, or tenant scope that owns this control.
2. Remediate the currently affected resources in batches, starting with internet-exposed and production assets.
3. Re-scan and track approved exceptions with an owner and expiry date.