Skip to content

Latest commit

 

History

History
31 lines (24 loc) · 1.36 KB

GCP_SecurityEngineerLearningPath_Part7--SecurityBestPracticesinGoogleCloud_SecuringCloudData-AuditingCloudData.md

File metadata and controls

31 lines (24 loc) · 1.36 KB
Raw

Link to Lesson:

Auditing Cloud Data

Auditing storage buckets

  • Cloud Storage bucket administrative activity is logged automatically: Logs of bucket data access must be turned on.

Enable logging within a bucket

  • Make a bucket to hold the logs.
  • Allow write access to the bucket.
  • Set logging on and specify the log bucket:
    • Storage logs are created once a day
    • Usage logs are created every hour
    gcloud storage buckets create gs://example-logs-bucket
    gsutil acl ch -g cloud-storage-analytics@google.com:W gs://example-logs-bucket
    gsutil defacl set project-private gs://example-logs-bucket
    gsutil logging set on -b gs://example-logs-bucket gs://example-bucket

Export the logs to BigQuery for analysis

  • Create a BigQuery dataset.
  • Use a load job to copy log data into BigQuery tables.
$   bq mk storageanalysis
$   bq load --skip_leading_rows=1 storageanalysis.usage gs://example-logs-bucket/example-bucket_usage_2018_01_15_14_00_00_1702e6_v0 ./cloud_storage_usage_schema_v0.json

$   bq load --skip_leading_rows=1 storageanalysis.storage gs://example-logs-bucket/example-bucket_storage_2018_01_05_14_00_00_091c5f_v0 ./cloud_storage_storage_schema_v0.json