GCP Logging & Detection Hardening

Author exactly one organization-scope Aggregated Sink with include_children = true that routes all projects', folders', and future-projects' logs into a security-team-owned destination set: (a) a Cloud Storage bucket in a dedicated security project with retention_policy { is_locked = true; retention_period_seconds = 63072000 } (two years, Bucket Lock immutable — cannot be reduced even by org admin); (b) a BigQuery dataset for SQL-based analytics and detection engineering; (c) a Cloud Logging bucket in the same security project for retention (Log Analytics queries plus a separate-from-project retention bucket; _Required and _Default log buckets remain at project scope) (Google Cloud — Aggregated Sinks documentation (accessed 2026-05)). Missing include_children = true on the org-level sink, or authoring sinks at project scope instead, is the canonical "we have logging" / "no we don't" misconfiguration; CIS GCP v4.0.0 §2.1, §2.2, and §2.3 codify the requirement. This is the audit log of last resort — without it, incident response is reconstructing intent from secondary signals.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create the dedicated security project + log destinations.
gcloud projects create sec-logs-prod --organization=ORG_ID
gcloud config set project sec-logs-prod

# Step 2: create the Cloud Storage destination bucket with retention lock.
gcloud storage buckets create gs://org-audit-logs-sec-prod \
  --location=EU \
  --uniform-bucket-level-access \
  --public-access-prevention

# Lock retention at 2y (cannot be reduced once locked).
gcloud storage buckets update gs://org-audit-logs-sec-prod \
  --retention-period=63072000s

gcloud storage buckets lock-retention-policy gs://org-audit-logs-sec-prod

# Step 3: create the BigQuery dataset for SQL forensics.
bq --location=EU mk --dataset \
  --default_table_expiration=63072000 \
  sec-logs-prod:org_audit

# Step 4: create the org-scope Aggregated Sink with include_children.
gcloud logging sinks create org-audit-sink-storage \
  storage.googleapis.com/org-audit-logs-sec-prod \
  --organization=ORG_ID \
  --include-children \
  --description="Org-aggregated audit-log sink to immutable Cloud Storage"

gcloud logging sinks create org-audit-sink-bq \
  bigquery.googleapis.com/projects/sec-logs-prod/datasets/org_audit \
  --organization=ORG_ID \
  --include-children \
  --use-partitioned-tables

# Step 5: grant the sinks' writer identities permission on their destinations.
WRITER=$(gcloud logging sinks describe org-audit-sink-storage \
  --organization=ORG_ID --format='value(writerIdentity)')

gcloud storage buckets add-iam-policy-binding gs://org-audit-logs-sec-prod \
  --member="$WRITER" \
  --role=roles/storage.objectCreator

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_storage_bucket" "org_audit_logs" {
  project                     = var.sec_project_id
  name                        = "org-audit-logs-sec-prod"
  location                    = "EU"
  uniform_bucket_level_access = true
  public_access_prevention    = "enforced"

  retention_policy {
    is_locked        = true
    retention_period = 63072000 # 2 years
  }

  versioning { enabled = true }
}

resource "google_bigquery_dataset" "org_audit" {
  project       = var.sec_project_id
  dataset_id    = "org_audit"
  location      = "EU"
  default_table_expiration_ms = 63072000000

  default_encryption_configuration {
    kms_key_name = var.log_bucket_kms_key
  }
}

resource "google_logging_organization_sink" "org_audit_storage" {
  name             = "org-audit-sink-storage"
  org_id           = var.org_id
  destination      = "storage.googleapis.com/${google_storage_bucket.org_audit_logs.name}"
  include_children = true
  filter           = ""
}

resource "google_logging_organization_sink" "org_audit_bq" {
  name             = "org-audit-sink-bq"
  org_id           = var.org_id
  destination      = "bigquery.googleapis.com/projects/${var.sec_project_id}/datasets/${google_bigquery_dataset.org_audit.dataset_id}"
  include_children = true
  filter           = ""

  bigquery_options {
    use_partitioned_tables = true
  }
}

resource "google_storage_bucket_iam_member" "sink_writer_storage" {
  bucket = google_storage_bucket.org_audit_logs.name
  role   = "roles/storage.objectCreator"
  member = google_logging_organization_sink.org_audit_storage.writer_identity
}

resource "google_bigquery_dataset_iam_member" "sink_writer_bq" {
  project    = var.sec_project_id
  dataset_id = google_bigquery_dataset.org_audit.dataset_id
  role       = "roles/bigquery.dataEditor"
  member     = google_logging_organization_sink.org_audit_bq.writer_identity
}

Remediation — Config Connector

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: org-aggregated-sink
  namespace: config-control
spec:
  resourceRef:
    apiVersion: resourcemanager.cnrm.cloud.google.com/v1beta1
    kind: Organization
    external: "organizations/ORG_ID"
  destination:
    bigQueryDatasetRef:
      external: "projects/LOG_PROJECT/datasets/security_audit"
  filter: 'logName:"cloudaudit.googleapis.com"'
  includeChildren: true

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// Org-level aggregated log sink to BigQuery for org-wide audit visibility.
const orgSink = new gcp.logging.OrganizationSink("org-aggregated-sink", {
    name: "org-aggregated-sink",
    orgId: orgId,
    destination: pulumi.interpolate`bigquery.googleapis.com/projects/${logProject}/datasets/security_audit`,
    filter: 'logName:"cloudaudit.googleapis.com"',
    includeChildren: true,
});

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="logging.googleapis.com"
          AND (protoPayload.methodName="google.logging.v2.ConfigServiceV2.UpdateSink"
               OR protoPayload.methodName="google.logging.v2.ConfigServiceV2.DeleteSink")
          AND resource.type="logging_sink"

Equivalent on: AWS · Azure · OCI

Enable Cloud Audit Logs Data Access logging — ADMIN_READ, DATA_READ, and DATA_WRITE — at organization scope via an organization-level Audit Config on allServices (with an explicit exemption list for service accounts whose read volume would make the cost envelope untenable) or, where cost forbids the umbrella, on the regulated-data services explicitly: Cloud Storage, BigQuery, Cloud SQL, Secret Manager, Cloud KMS, and the IAM service itself (iam.googleapis.com) — the latter is particularly important because IAMPolicy Data Access logs capture the policy-read calls an attacker uses to enumerate IAM bindings before privilege escalation (Google Cloud — Configure Data Access audit logs (accessed 2026-05)). Data Access logs are off by default and are chargeable — that is precisely the reason they get missed in audit-trail design, and precisely the reason they must be enabled before an incident. Without them, an attacker who has obtained read access to a Cloud Storage bucket of secrets, a BigQuery dataset of customer records, or a Secret Manager version can perform the read with no log entry visible to the investigator after the fact.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: fetch the current organization IAM policy.
gcloud organizations get-iam-policy ORG_ID --format=json > org-policy.json

# Step 2: edit the auditConfigs block to enable the three Data Access streams.
# Append (or merge with) this object inside auditConfigs:
cat >> org-policy.json.fragment <<'JSON'
{
  "auditConfigs": [
    {
      "service": "allServices",
      "auditLogConfigs": [
        { "logType": "ADMIN_READ" },
        { "logType": "DATA_READ",
          "exemptedMembers": [
            "serviceAccount:high-volume-batch@PROJECT.iam.gserviceaccount.com"
          ]
        },
        { "logType": "DATA_WRITE" }
      ]
    },
    {
      "service": "iam.googleapis.com",
      "auditLogConfigs": [
        { "logType": "ADMIN_READ" },
        { "logType": "DATA_READ" },
        { "logType": "DATA_WRITE" }
      ]
    }
  ]
}
JSON

# Step 3: apply the merged policy back.
gcloud organizations set-iam-policy ORG_ID org-policy.json

# Step 4: verify Data Access is now on for the regulated surface.
gcloud organizations get-iam-policy ORG_ID \
  --format='json(auditConfigs)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_organization_iam_audit_config" "all_services" {
  org_id  = var.org_id
  service = "allServices"

  audit_log_config { log_type = "ADMIN_READ" }

  audit_log_config {
    log_type = "DATA_READ"
    exempted_members = [
      "serviceAccount:high-volume-batch@${var.batch_project_id}.iam.gserviceaccount.com",
    ]
  }

  audit_log_config { log_type = "DATA_WRITE" }
}

# IAMPolicy Data Access is particularly important for reconnaissance detection.
resource "google_organization_iam_audit_config" "iam_service" {
  org_id  = var.org_id
  service = "iam.googleapis.com"

  audit_log_config { log_type = "ADMIN_READ" }
  audit_log_config { log_type = "DATA_READ" }
  audit_log_config { log_type = "DATA_WRITE" }
}

resource "google_organization_iam_audit_config" "crm_service" {
  org_id  = var.org_id
  service = "cloudresourcemanager.googleapis.com"

  audit_log_config { log_type = "ADMIN_READ" }
  audit_log_config { log_type = "DATA_READ" }
  audit_log_config { log_type = "DATA_WRITE" }
}

Remediation — Infrastructure Manager

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.methodName="SetIamPolicy"
          AND protoPayload.serviceData.policyDelta.auditConfigDeltas.action="REMOVE"
          AND (protoPayload.serviceData.policyDelta.auditConfigDeltas.logType="DATA_READ"
               OR protoPayload.serviceData.policyDelta.auditConfigDeltas.logType="DATA_WRITE")

Equivalent on: AWS · Azure · OCI

Security Command Center Premium — Regulatory Compliance dashboard

Activate Security Command Center Premium at organization scope and enable the Regulatory Compliance dashboard, which maps Security Health Analytics findings to CIS GCP v4.0.0 detector IDs plus PCI DSS, HIPAA, and ISO 27001 control sets (Google Cloud — Security Command Center overview (accessed 2026-05)). Critical caveat to cite explicitly in any compliance attestation that references SCC built-in detector results: as of writing, Google's SCC built-in compliance detector certification still covers CIS GCP v2.0.0; v4.0.0 detector parity is closed externally — either via the official Google InSpec profile inspec-gcp-cis-benchmark tagged v4.0.0 release (GoogleCloudPlatform — inspec-gcp-cis-benchmark v4.0.0 (accessed 2026-05)) or via third-party CSPM tooling. The dashboard remains useful for the v2.0.0 baseline plus the per-finding remediation playbooks, and the dashboard's PCI / HIPAA / ISO mappings are not affected by the CIS-version lag. This control is the compliance-posture surface of SCC; gcp-log-04 is the threat-detection surface and gcp-log-05 is the SHA finding-lifecycle surface — three separate review workflows on the same SCC engine.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable SCC Premium services at organization scope.
gcloud scc settings services update \
  --service=SECURITY_HEALTH_ANALYTICS \
  --enablement-state=ENABLED \
  --organization=ORG_ID

# Step 2: enable Web Security Scanner (Premium-only managed module).
gcloud scc settings services update \
  --service=WEB_SECURITY_SCANNER \
  --enablement-state=ENABLED \
  --organization=ORG_ID

# Step 3: confirm SCC tier (Premium) and SHA module activation.
gcloud scc settings describe --organization=ORG_ID

gcloud scc settings services describe SECURITY_HEALTH_ANALYTICS \
  --organization=ORG_ID

# Step 4: pull the v4.0.0 InSpec profile for the CIS gap detector set
# (closes the SCC-v2.0.0-certified-only caveat).
git clone --branch v4.0.0 \
  https://github.com/GoogleCloudPlatform/inspec-gcp-cis-benchmark.git
inspec exec inspec-gcp-cis-benchmark \
  -t gcp:// \
  --input gcp_project_id=PROJECT_ID \
         gcp_organization_id=ORG_ID

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
# Note: SCC organization-tier activation is primarily console / gcloud at
# writing time; Terraform coverage of org-level service-enablement is
# partial — re-verify against the google + google-beta providers at apply.
# Custom-module authoring is supported and shown here.

resource "google_scc_organization_custom_module" "deny_public_bucket" {
  organization = var.org_id
  display_name = "deny-public-storage-bucket"
  enablement_state = "ENABLED"

  custom_config {
    predicate {
      expression = "resource.iamPolicy.bindings.exists(b, b.members.exists(m, m == 'allUsers' || m == 'allAuthenticatedUsers'))"
    }
    resource_selector {
      resource_types = ["storage.googleapis.com/Bucket"]
    }
    severity      = "HIGH"
    description   = "Cloud Storage bucket IAM grants allUsers/allAuthenticatedUsers"
    recommendation = "Remove allUsers/allAuthenticatedUsers bindings; enforce public_access_prevention=enforced"
  }
}

# Pin the Compliance source so dashboard IDs are referenceable from runbooks.
data "google_scc_source" "compliance" {
  organization = var.org_id
  display_name = "Security Health Analytics"
}

Remediation — Infrastructure Manager

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="securitycenter.googleapis.com"
          AND (protoPayload.methodName=~".*UpdateOrganizationSettings"
               OR protoPayload.methodName=~".*CreateMuteConfig"
               OR protoPayload.methodName=~".*UpdateMuteConfig")

Equivalent on: AWS · Azure · OCI

Security Command Center Premium — Threat Detection

Enable the four threat-detection services that ship with Security Command Center Premium at organization scope: Event Threat Detection (authentication anomalies, service-account key abuse, anomalous IAM grants, suspicious cross-project access, brute-force SSH against Compute Engine), Container Threat Detection (runtime detections on GKE workloads — added binaries inside containers, reverse shells, malicious scripts, Linux Bash root histories), Virtual Machine Threat Detection (cryptomining detection on Compute Engine via guest-memory scanning, no agent required), and the legacy Anomaly Detection heuristic engine (Google Cloud — Event Threat Detection overview (accessed 2026-05)). Anti-conflation: this is the threat-detection surface of SCC; the compliance dashboard is gcp-log-03 and the SHA finding lifecycle is gcp-log-05. SCC Enterprise tier is called out as the multi-cloud CNAPP upgrade — it adds Mandiant threat-intelligence feeds, multi-cloud asset inventory (covering AWS / Azure), and a SOAR-style case-management surface — and is the right tier for organisations running a multi-cloud SOC. The corpus baseline is SCC Premium per the ROADMAP success criterion that explicitly pins "Security Command Center Premium finding types"; Enterprise is referenced in prose, not as the primary recommendation. CRITICAL severity because threat detection is the only signal that runtime compromise is currently in progress (versus posture findings, which describe latent risk).

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable the four threat-detection services at organization scope.
for svc in EVENT_THREAT_DETECTION \
           CONTAINER_THREAT_DETECTION \
           VIRTUAL_MACHINE_THREAT_DETECTION \
           SECURITY_HEALTH_ANALYTICS; do
  gcloud scc settings services update \
    --service="$svc" \
    --enablement-state=ENABLED \
    --organization=ORG_ID
done

# Step 2: confirm activation per-service.
for svc in EVENT_THREAT_DETECTION \
           CONTAINER_THREAT_DETECTION \
           VIRTUAL_MACHINE_THREAT_DETECTION; do
  gcloud scc settings services describe "$svc" \
    --organization=ORG_ID \
    --format='value(serviceEnablementState)'
done

# Step 3: list active threat-detection findings across the org.
gcloud scc findings list ORG_ID \
  --filter='category=~"EXFIL|CRYPTOMINING|MALWARE|SUSPICIOUS|BACKDOOR"
            AND state="ACTIVE"' \
  --format='table(name, category, severity, eventTime)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
# Note: org-tier service-enablement for SCC Premium threat-detection services
# is partially supported in google_scc_organization_custom_module form;
# the canonical activation path is gcloud / console. Re-verify support level
# in the google + google-beta providers at apply time. The custom-module
# pattern below shows the supported Terraform-native surface (organisation
# custom detectors that augment the built-in threat-detection set).

resource "google_scc_organization_custom_module" "anomalous_sa_key_create" {
  organization     = var.org_id
  display_name     = "anomalous-sa-key-creation"
  enablement_state = "ENABLED"

  custom_config {
    predicate {
      expression = "resource.type == 'iam.googleapis.com/ServiceAccountKey' && resource.createTime > timestamp(now - duration('1h'))"
    }
    resource_selector {
      resource_types = ["iam.googleapis.com/ServiceAccountKey"]
    }
    severity      = "HIGH"
    description   = "New service account key created — possible credential persistence"
    recommendation = "Audit the creating principal; rotate or delete the key if not expected"
  }
}

# Route threat-detection findings into Pub/Sub for downstream automation
# (the Pub/Sub topic + Cloud Function pair is in gcp-log-05).
resource "google_scc_notification_config" "threat_high_critical" {
  config_id    = "threat-detection-high-critical"
  organization = var.org_id
  description  = "HIGH+CRITICAL threat-detection findings → SOC playbook"
  pubsub_topic = google_pubsub_topic.scc_findings.id

  streaming_config {
    filter = "severity = \"HIGH\" OR severity = \"CRITICAL\""
  }
}

Remediation — Infrastructure Manager

Remediation — Pulumi (TypeScript)

import * as gcp from "@pulumi/gcp";

// SCC organisation custom module — SCC Premium tier required.
const customModule = new gcp.securitycenter.OrganizationCustomModule("scc-custom", {
    organization: orgId,
    displayName: "scc-prod-baseline",
    enablementState: "ENABLED",
    customConfig: {
        predicate: {
            expression: "resource.publicAccessPrevention != 'enforced'",
        },
        recommendation: "Set publicAccessPrevention=enforced on every bucket.",
        description: "Detect storage buckets without PAP enforcement.",
        severity: "HIGH",
        resourceSelector: {
            resourceTypes: ["storage.googleapis.com/Bucket"],
        },
    },
});

Compliance mapping

logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="securitycenter.googleapis.com"
          AND (protoPayload.methodName=~".*Module.*"
               OR protoPayload.methodName=~".*EventThreatDetection.*")
          AND (protoPayload.request.module.moduleEnablementState="DISABLED"
               OR protoPayload.methodName=~".*Delete.*")

Equivalent on: AWS · Azure · OCI

Security Command Center Premium — Security Health Analytics finding lifecycle

Treat Security Health Analytics (SHA) findings as a managed work queue with a defined cadence and per-event automation: monthly review of all OPEN findings across HIGH and CRITICAL severities at the security-team standup, and a Pub/Sub notification → Cloud Function (Gen 2) playbook chain on every new HIGH or CRITICAL finding so the urgent ones do not wait for the monthly review (Google Cloud — SCC notification configs documentation (accessed 2026-05)). Anti-conflation: this is the lifecycle / recommendation-management surface of SCC; the compliance dashboard is gcp-log-03 and the live threat-detection surface is gcp-log-04. The three controls describe three review rituals on the same SCC engine — monthly posture review (this control), continuous threat triage (gcp-log-04), and compliance reporting (gcp-log-03) — which is why folding them into one umbrella loses the operational signal. The auto-remediation Cloud Function carries playbooks for the canonical SHA categories: PUBLIC_BUCKET_ACL → set bucket public_access_prevention = "enforced"; OPEN_FIREWALL → narrow source ranges; SERVICE_ACCOUNT_KEY_NOT_ROTATED → enqueue rotation reminder; WEAK_SSL_POLICY → swap load-balancer SSL policy. Posture Management within SCC is referenced as the opinionated baseline (re-verify GA versus preview status at writing time).

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create the Pub/Sub topic that receives SCC notifications.
gcloud pubsub topics create scc-findings-high-critical \
  --project=sec-logs-prod

# Step 2: register the SCC notification config (HIGH + CRITICAL severities).
gcloud scc notifications create scc-high-critical \
  --organization=ORG_ID \
  --description="HIGH + CRITICAL SHA findings → automated remediation" \
  --pubsub-topic=projects/sec-logs-prod/topics/scc-findings-high-critical \
  --filter='severity = "HIGH" OR severity = "CRITICAL"'

# Step 3: deploy the remediation Cloud Function (Gen 2).
gcloud functions deploy scc-remediate \
  --gen2 \
  --region=europe-west1 \
  --runtime=python312 \
  --source=./scc-remediate \
  --entry-point=handle_finding \
  --trigger-topic=scc-findings-high-critical \
  --service-account=scc-remediator@sec-logs-prod.iam.gserviceaccount.com \
  --max-instances=10

# Step 4: list current OPEN HIGH+CRITICAL findings (monthly review query).
gcloud scc findings list ORG_ID \
  --filter='state="ACTIVE" AND (severity="HIGH" OR severity="CRITICAL")' \
  --format='table(name.basename(), category, severity, resourceName, eventTime)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_pubsub_topic" "scc_findings" {
  project = var.sec_project_id
  name    = "scc-findings-high-critical"
}

resource "google_scc_notification_config" "high_critical" {
  config_id    = "scc-high-critical"
  organization = var.org_id
  description  = "HIGH+CRITICAL SHA + threat-detection findings"
  pubsub_topic = google_pubsub_topic.scc_findings.id

  streaming_config {
    filter = "severity = \"HIGH\" OR severity = \"CRITICAL\""
  }
}

resource "google_service_account" "scc_remediator" {
  project      = var.sec_project_id
  account_id   = "scc-remediator"
  display_name = "SCC auto-remediation function identity"
}

resource "google_cloudfunctions2_function" "scc_remediate" {
  project  = var.sec_project_id
  name     = "scc-remediate"
  location = "europe-west1"

  build_config {
    runtime     = "python312"
    entry_point = "handle_finding"
    source {
      storage_source {
        bucket = var.function_source_bucket
        object = "scc-remediate.zip"
      }
    }
  }

  service_config {
    max_instance_count = 10
    available_memory   = "512M"
    service_account_email = google_service_account.scc_remediator.email
    ingress_settings   = "ALLOW_INTERNAL_ONLY"
  }

  event_trigger {
    trigger_region = "europe-west1"
    event_type     = "google.cloud.pubsub.topic.v1.messagePublished"
    pubsub_topic   = google_pubsub_topic.scc_findings.id
    retry_policy   = "RETRY_POLICY_RETRY"
  }
}

Remediation — Infrastructure Manager

Compliance mapping

(logName=~"organizations/.*/logs/cloudaudit.googleapis.com%2Factivity"
           AND protoPayload.serviceName="securitycenter.googleapis.com"
           AND protoPayload.methodName=~".*NotificationConfig.*")
          OR
          (logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
           AND protoPayload.serviceName="pubsub.googleapis.com"
           AND protoPayload.methodName=~"google.pubsub.v1.(Publisher.DeleteTopic|Subscriber.DeleteSubscription)"
           AND protoPayload.resourceName=~".*scc-findings.*")

Equivalent on: AWS · Azure · OCI

Enable VPC Flow Logs on every subnet that hosts workloads, with flow_sampling = 1.0 on security-critical subnets (administrative, regulated-data, internet-facing) and flow_sampling = 0.5 on high-volume application subnets where 100% capture is cost-prohibitive; aggregation interval at INTERVAL_5_SEC for the security-sensitive set and at INTERVAL_30_SEC for the rest; metadata INCLUDE_ALL_METADATA so the flow record carries source-instance, source-pod (where Dataplane V2 applies), and target-service annotations the investigator needs (Google Cloud — VPC Flow Logs documentation (accessed 2026-05)). Flow logs land in Cloud Logging and ride the aggregated sink to BigQuery for SQL-based investigation. Packet Mirroring (configured via google_compute_packet_mirroring) is the IDS-grade companion when full L7 inspection is required — Flow Logs are connection-summary records, not packet captures; Packet Mirroring replicates full packets to a destination ILB for inspection by a network IDS appliance (Suricata, Zeek, or a vendor virtual-appliance). The pair-control on the network page (gcp-net-08 cross-domain) handles egress-IP control; this control handles the per-flow record after the flow has been allowed.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: enable Flow Logs on a security-critical subnet (100% sampling).
gcloud compute networks subnets update snet-app-prod-euw1 \
  --project=svc-app-prod \
  --region=europe-west1 \
  --enable-flow-logs \
  --logging-aggregation-interval=INTERVAL_5_SEC \
  --logging-flow-sampling=1.0 \
  --logging-metadata=INCLUDE_ALL_METADATA

# Step 2: enable Flow Logs on a high-volume application subnet (50% sampling).
gcloud compute networks subnets update snet-app-edge-euw1 \
  --project=svc-app-prod \
  --region=europe-west1 \
  --enable-flow-logs \
  --logging-aggregation-interval=INTERVAL_30_SEC \
  --logging-flow-sampling=0.5 \
  --logging-metadata=INCLUDE_ALL_METADATA

# Step 3: verify Flow Logs config across all subnets in the project.
gcloud compute networks subnets list --project=svc-app-prod \
  --format='table(name, region, logConfig.enable, logConfig.flowSampling)'

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_compute_subnetwork" "snet_app_prod_euw1" {
  project       = var.host_project_id
  name          = "snet-app-prod-euw1"
  network       = var.vpc_self_link
  region        = "europe-west1"
  ip_cidr_range = "10.40.0.0/22"

  private_ip_google_access = true

  log_config {
    aggregation_interval = "INTERVAL_5_SEC"
    flow_sampling        = 1.0
    metadata             = "INCLUDE_ALL_METADATA"
  }
}

# Packet Mirroring for IDS-grade inspection on the security-critical subnet.
resource "google_compute_packet_mirroring" "ids_mirror" {
  project = var.host_project_id
  name    = "ids-mirror-app-prod"
  region  = "europe-west1"

  network {
    url = var.vpc_self_link
  }

  collector_ilb {
    url = var.ids_collector_ilb_self_link
  }

  mirrored_resources {
    subnetworks {
      url = google_compute_subnetwork.snet_app_prod_euw1.self_link
    }
  }
}

Remediation — Config Connector

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSubnetwork
metadata:
  name: prod-subnet-flow-logs
  namespace: config-control
spec:
  region: us-central1
  ipCidrRange: "10.0.0.0/20"
  networkRef:
    name: prod-vpc
  logConfig:
    aggregationInterval: INTERVAL_5_SEC
    flowSampling: 0.5
    metadata: INCLUDE_ALL_METADATA

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="compute.googleapis.com"
          AND protoPayload.methodName="v1.compute.subnetworks.patch"
          AND (protoPayload.request.logConfig.enable=false
               OR protoPayload.request.logConfig.flowSampling<0.5)

Equivalent on: AWS · Azure · OCI

Author log-based metrics and Cloud Monitoring alert policies on the canonical security-event log filters from CIS GCP v4.0.0 §2.4–§2.16: IAM policy changes (protoPayload.methodName=~"SetIamPolicy"), log sink modifications, VPC firewall changes, VPC network changes, VPC route changes, Cloud KMS CryptoKey changes / destruction, project ownership changes, Audit Config changes, Cloud SQL instance modifications, Cloud Storage IAM policy changes, custom-role definition changes (Google Cloud — Log-based metrics documentation (accessed 2026-05)). Each metric is paired with a Cloud Monitoring alert policy with a 1-occurrence threshold over a 5-minute window — the value is in fast detection of the configuration change, not in counting how many times it happened. The Terraform pattern uses for_each over a locals map of canonical event filters, mirroring the AWS Phase 6 aws-log-07 CloudWatch-alarms-for_each pattern and the Azure Phase 7 azure-log-07 alert-rule pattern — extensible without per-alarm boilerplate.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create a log-based metric on IAM policy changes (CIS GCP 2.4).
gcloud logging metrics create iam_policy_changes \
  --project=sec-logs-prod \
  --description='IAM policy changes (CIS GCP 2.4)' \
  --log-filter='protoPayload.methodName="SetIamPolicy"
                OR protoPayload.methodName=~"SetIamPolicy$"'

# Step 2: create a log-based metric on log sink modifications (CIS GCP 2.5).
gcloud logging metrics create logging_sink_changes \
  --project=sec-logs-prod \
  --description='Log sink modifications (CIS GCP 2.5)' \
  --log-filter='protoPayload.methodName=~"logging.sinks.(create|update|delete)$"'

# Step 3: create a log-based metric on VPC firewall changes (CIS GCP 3.7 alert).
gcloud logging metrics create vpc_firewall_changes \
  --project=sec-logs-prod \
  --description='VPC firewall rule changes (CIS GCP 2.7)' \
  --log-filter='resource.type="gce_firewall_rule"
                AND (protoPayload.methodName=~"firewalls.(insert|patch|delete)$")'

# Step 4: bind a Cloud Monitoring alert policy to each metric.
# (Policy authoring shown in the Terraform block below for the canonical set.)

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
locals {
  canonical_events = {
    iam_policy_changes = {
      filter = "protoPayload.methodName=~\"SetIamPolicy$\""
      cis    = "2.4"
    }
    logging_sink_changes = {
      filter = "protoPayload.methodName=~\"logging.sinks.(create|update|delete)$\""
      cis    = "2.5"
    }
    audit_config_changes = {
      filter = "protoPayload.methodName=\"SetIamPolicy\" AND protoPayload.serviceData.policyDelta.auditConfigDeltas:*"
      cis    = "2.6"
    }
    vpc_firewall_changes = {
      filter = "resource.type=\"gce_firewall_rule\" AND protoPayload.methodName=~\"firewalls.(insert|patch|delete)$\""
      cis    = "2.7"
    }
    vpc_network_changes = {
      filter = "resource.type=\"gce_network\" AND protoPayload.methodName=~\"networks.(insert|patch|delete)$\""
      cis    = "2.8"
    }
    vpc_route_changes = {
      filter = "resource.type=\"gce_route\" AND protoPayload.methodName=~\"routes.(insert|delete)$\""
      cis    = "2.9"
    }
    storage_iam_changes = {
      filter = "resource.type=\"gcs_bucket\" AND protoPayload.methodName=\"storage.setIamPermissions\""
      cis    = "2.10"
    }
    sql_instance_changes = {
      filter = "protoPayload.methodName=~\"cloudsql.instances.(create|update|delete)$\""
      cis    = "2.11"
    }
    kms_key_destruction = {
      filter = "resource.type=\"cloudkms_cryptokey\" AND protoPayload.methodName=~\"DestroyCryptoKeyVersion$\""
      cis    = "2.12"
    }
    project_ownership_changes = {
      filter = "(protoPayload.serviceName=\"cloudresourcemanager.googleapis.com\") AND (ProjectOwnership OR projectOwnerInvitee)"
      cis    = "2.13"
    }
    custom_role_changes = {
      filter = "resource.type=\"iam_role\" AND protoPayload.methodName=~\"google.iam.admin.v1.(Create|Update|Delete)Role$\""
      cis    = "2.14"
    }
  }
}

resource "google_logging_metric" "canonical_events" {
  for_each = local.canonical_events
  project  = var.sec_project_id
  name     = each.key
  filter   = each.value.filter

  metric_descriptor {
    metric_kind = "DELTA"
    value_type  = "INT64"
    unit        = "1"
  }

  description = "CIS GCP v4.0.0 §${each.value.cis} canonical event"
}

resource "google_monitoring_alert_policy" "canonical_events" {
  for_each     = local.canonical_events
  project      = var.sec_project_id
  display_name = "alert-${each.key}"
  combiner     = "OR"
  notification_channels = var.notification_channel_ids

  conditions {
    display_name = "occurrence threshold"
    condition_threshold {
      filter          = "metric.type=\"logging.googleapis.com/user/${each.key}\" AND resource.type=\"global\""
      duration        = "0s"
      comparison      = "COMPARISON_GT"
      threshold_value = 0

      aggregations {
        alignment_period   = "300s"
        per_series_aligner = "ALIGN_DELTA"
      }
    }
  }

  alert_strategy {
    auto_close = "1800s"
  }
}

Remediation — Config Connector

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogMetric
metadata:
  name: iam-policy-changes
  namespace: config-control
spec:
  projectRef:
    external: "projects/PROJECT_ID"
  filter: 'protoPayload.methodName="SetIamPolicy" AND severity>=NOTICE'
  metricDescriptor:
    metricKind: DELTA
    valueType: INT64

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND ((protoPayload.serviceName="monitoring.googleapis.com"
                AND protoPayload.methodName=~".*AlertPolicy.*"
                AND protoPayload.request.alertPolicy.enabled=false)
               OR (protoPayload.serviceName="logging.googleapis.com"
                   AND protoPayload.methodName=~".*LogMetric.Delete.*"))

Equivalent on: AWS · Azure · OCI

Author a dedicated BigQuery-destination Aggregated Sink that ships every audit-log entry from every project in the organization to a partitioned BigQuery dataset in a security-team-owned project, with two-year partition expiration, CMEK encryption on the dataset, and a saved SQL forensic-query library checked into version control (Google Cloud — Configure BigQuery log sinks (accessed 2026-05)). RESPONSIVE typing because the operational value is the during-incident and post-incident SQL forensic workflow — partitioned, queryable, and joinable against asset-inventory and CMDB tables — not the steady-state detection signal (which is owned by gcp-log-07) or the canonical retention store (which is owned by gcp-log-01). Mirrors the AWS pattern aws-log-08-cloudtrail-lake (CloudTrail Lake SQL forensic store) and the Azure pattern azure-log-08-sentinel-data-lake (Microsoft Sentinel data-lake / Log Analytics dedicated cluster). Pairs cross-domain with the IR forensic SQL workflow on gcp-ir-04.

Remediation — gcloud CLI

# gcloud CLI (latest stable)
# Step 1: create the dedicated forensic BigQuery dataset with CMEK.
bq --location=EU mk --dataset \
  --default_table_expiration=63072000 \
  --default_kms_key=projects/sec-logs-prod/locations/europe/keyRings/log-kr/cryptoKeys/log-cmek \
  sec-logs-prod:audit_forensic

# Step 2: author the org-scope Aggregated Sink to BigQuery with partitioned tables.
gcloud logging sinks create org-audit-sink-bq-forensic \
  bigquery.googleapis.com/projects/sec-logs-prod/datasets/audit_forensic \
  --organization=ORG_ID \
  --include-children \
  --use-partitioned-tables \
  --description="Forensic SQL store: org-aggregated audit logs, partitioned by day, 2y expiration"

# Step 3: grant the sink writer identity bigquery.dataEditor on the dataset.
WRITER=$(gcloud logging sinks describe org-audit-sink-bq-forensic \
  --organization=ORG_ID --format='value(writerIdentity)')

bq add-iam-policy-binding \
  --member="$WRITER" \
  --role=roles/bigquery.dataEditor \
  sec-logs-prod:audit_forensic

# Step 4: example forensic query — what did SA X do in the last 24h?
bq query --use_legacy_sql=false <<'SQL'
SELECT timestamp,
       protopayload_auditlog.methodName    AS method,
       protopayload_auditlog.resourceName   AS resource,
       protopayload_auditlog.authenticationInfo.principalEmail AS who
FROM `sec-logs-prod.audit_forensic.cloudaudit_googleapis_com_activity_*`
WHERE _TABLE_SUFFIX BETWEEN
        FORMAT_DATE('%Y%m%d', DATE_SUB(CURRENT_DATE(), INTERVAL 1 DAY))
        AND FORMAT_DATE('%Y%m%d', CURRENT_DATE())
  AND protopayload_auditlog.authenticationInfo.principalEmail
      = 'sa-suspect@svc-app-prod.iam.gserviceaccount.com'
ORDER BY timestamp DESC
LIMIT 500
SQL

Remediation — Terraform

# Terraform Google provider ~> 5.0
# Source: Google Cloud docs (accessed 2026-05)
resource "google_bigquery_dataset" "audit_forensic" {
  project    = var.sec_project_id
  dataset_id = "audit_forensic"
  location   = "EU"
  default_partition_expiration_ms = 63072000000 # 2y
  default_table_expiration_ms     = 63072000000

  default_encryption_configuration {
    kms_key_name = var.log_bucket_kms_key
  }
}

resource "google_logging_organization_sink" "audit_forensic" {
  name             = "org-audit-sink-bq-forensic"
  org_id           = var.org_id
  destination      = "bigquery.googleapis.com/projects/${var.sec_project_id}/datasets/${google_bigquery_dataset.audit_forensic.dataset_id}"
  include_children = true
  filter           = ""

  bigquery_options {
    use_partitioned_tables = true
  }
}

resource "google_bigquery_dataset_iam_member" "sink_writer" {
  project    = var.sec_project_id
  dataset_id = google_bigquery_dataset.audit_forensic.dataset_id
  role       = "roles/bigquery.dataEditor"
  member     = google_logging_organization_sink.audit_forensic.writer_identity
}

Remediation — Config Connector

apiVersion: logging.cnrm.cloud.google.com/v1beta1
kind: LoggingLogSink
metadata:
  name: bigquery-audit-sink
  namespace: config-control
spec:
  projectRef:
    external: "projects/PROJECT_ID"
  destination:
    bigQueryDatasetRef:
      external: "projects/PROJECT_ID/datasets/audit_archive"
  filter: 'logName:"cloudaudit.googleapis.com" AND severity>=NOTICE'

Compliance mapping

logName=~"projects/.*/logs/cloudaudit.googleapis.com%2Factivity"
          AND protoPayload.serviceName="bigquery.googleapis.com"
          AND (protoPayload.methodName="google.cloud.bigquery.v2.DatasetService.DeleteDataset"
               OR protoPayload.methodName="google.cloud.bigquery.v2.TableService.DeleteTable"
               OR protoPayload.methodName="google.cloud.bigquery.v2.DatasetService.PatchDataset")
          AND protoPayload.resourceName=~".*audit_logs.*"

Equivalent on: AWS · Azure · OCI