Check provider logo

IAM Audit Not Properly Configured

GCP-0079

Severitylow
Servicegoogle/iam
by Prowler

IAM Audit Logging should be configured for all services and the appropriate log types to track changes and accesses.

Risk

No content available

Run this check with Prowler CLI

prowler iac

Run in Prowler Cloud

Recommendation

Configure IAM Audit Logs for required services and log types. In Terraform, use google_project_iam_audit_config to specify the services and log types (ADMIN_READ, DATA_READ, DATA_WRITE) to be audited. Note: DATA_READ and DATA_WRITE audit logs can generate significant volumes and costs for high-traffic applications. Consider implementing exemptions for service accounts and evaluating cost implications before enabling for all services.

Remediation

Terraform
Other

IAM Audit Logging should be configured for all services and the appropriate log types to track changes and accesses.

References