> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-5.md).

# GCP Project audit logging is not configured properly across all services and all users in a project

## Rule Details

|                        |                                      |
| ---------------------- | ------------------------------------ |
| Cortex AppSec Rule ID  | APPSEC2\_GCP\_5                      |
| Category - Subcategory | Logging - Disabled or missing        |
| Provider               | GCP                                  |
| Severity               | LOW                                  |
| Framework              | Terraform, Terraform Plan            |
| Mapped CSPM/KSPM Rule  | 313db4e8-a0c8-4758-a6ce-9c12b0fc9d79 |

## Impact

It is recommended that Cloud Audit Logging is configured to track all admin activities and read, write access to user data. Cloud Audit Logging maintains two audit logs for each project, folder, and organization: Admin Activity and Data Access.

. Admin Activity logs contain log entries for API calls or other administrative actions that modify the configuration or metadata of resources. + Admin Activity audit logs are enabled for all services and cannot be configured.

. Data Access audit logs record API calls that create, modify, or read user-provided data. + These are disabled by default and should be enabled. + There are three kinds of Data Access audit log information: + \*\* Admin read: Records operations that read metadata or configuration information. + Admin Activity audit logs record writes of metadata and configuration information that cannot be disabled. + \*\* Data read: Records operations that read user-provided data. + o Data write: Records operations that write user-provided data. + It is recommended to have an effective default audit config configured in such a way that:

. logtype is set to DATA\_READ (to log user activity tracking) and DATA\_WRITES (to log changes/tampering to user data).

. audit config is enabled for all the services supported by the Data Access audit logs feature.

. Logs should be captured for all users, i.e., there are no exempted users in any of the audit config sections. + This will ensure overriding the audit config will not contradict the requirement.

## How to Fix

*Resource:* google\_project

* *Arguments:* google\_project\_iam\_audit\_config \[source,go]

***

resource "google\_project" "good\_project" { name = "good" project\_id = "123456" }

resource "google\_project" "bad\_project" { name = "bad" project\_id = "123456" }

resource "google\_project\_iam\_audit\_config" "project\_good\_audit" { project = google\_project.good\_project.id

* service = "allServices" audit\_log\_config { log\_type = "ADMIN\_READ" } audit\_log\_config { log\_type = "DATA\_READ" } audit\_log\_config { log\_type = "DATA\_WRITE" } }

resource "google\_project\_iam\_audit\_config" "project\_bad\_audit" { project = google\_project.bad\_project.id

* service = "someService" audit\_log\_config { log\_type = "ADMIN\_READ" } audit\_log\_config { log\_type = "DATA\_READ"
* exempted\_members = \[
* "user:<joebloggs@hashicorp.com>",
* ] } }

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/appsec-rules/iac-security/logging/appsec2-gcp-5.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.