Skip to content

Commit 2f8b0c7

Browse files
tyler-dunkeltyler-dunkel
authored
Merge pull request #99 from cloudgraphdev/feature/CG-1151-support-gcp-nist
feat(CG-1151): support gcp nist IAM default audit log config check
2 parents 03b4e57 + b821ecf commit 2f8b0c7

4 files changed

Lines changed: 157 additions & 3 deletions

File tree

‎src/gcp/nist-800-53-rev4/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,7 @@ Policy Pack based on the [800-53 Rev. 4](https://csrc.nist.gov/publications/deta
7575
| GCP NIST 3.8 | PostgreSQL database instance 'log_min_duration_statement' database flag should be set to '-1' (disabled) |
7676
| GCP NIST 3.9 | At least one project-level logging sink should be configured with an empty filter |
7777
| GCP NIST 3.10 | Network subnet flow logs should be enabled |
78+
| GCP NIST 3.11 | IAM default audit log config should include 'DATA_READ' and 'DATA_WRITE' log types |
7879
| GCP NIST 4.1 | Compute instance disks should be encrypted with customer-supplied encryption keys (CSEKs) |
7980
| GCP NIST 4.2 | SQL database instances should require incoming connections to use SSL |
8081
| GCP NIST 5.1 | Logging metric filter and alert for project ownership assignments/changes should be configured |

‎src/gcp/nist-800-53-rev4/rules/gcp-nist-800-53-rev4-3.11.ts‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
export default {
2+
id: 'gcp-nist-800-53-rev4-3.11',
3+
title:
4+
'GCP NIST 3.11 IAM default audit log config should include \'DATA_READ\' and \'DATA_WRITE\' log types',
5+
description:
6+
'A best practice is to enable \'DATA_READ\' and \'DATA_WRITE\' data access log types as part of the default IAM audit log config, so that read and write operations on user-provided data are tracked across all relevant services. Please note that the \'ADMIN_WRITE\' log type and BigQuery data access logs are enabled by default.',
7+
8+
audit: '',
9+
rationale: '',
10+
remediation: `**From Console:**
11+
12+
1. Navigate to IAM & Admin, Audit Logs, or using https://console.cloud.google.com/iam-admin/audit
13+
2. Click on Set Default Configuration at the top of the page.
14+
34. In the Log Type tab, select the Data Write and Data Read boxes.
15+
4. Click Save.
16+
17+
**From Command Line:**
18+
1. Run the following command to read the project’s IAM policy:
19+
20+
gcloud projects get-iam-policy PROJECT_ID > /tmp/project_policy.yaml
21+
22+
2. Alternatively, the policy can be set at the organization or folder level. If setting the policy at the organization level, it is not necessary to also set it for each folder or project.
23+
24+
gcloud organizations get-iam-policy ORGANIZATION_ID > /tmp/org_policy.yaml
25+
gcloud resource-manager folders get-iam-policy FOLDER_ID > /tmp/folder_policy.yaml
26+
27+
3. Edit policy in /tmp/policy.yaml, adding or changing only the audit logs configuration to:
28+
29+
auditConfigs:
30+
- auditLogConfigs:
31+
- logType: DATA_WRITE
32+
- logType: DATA_READ
33+
service: allServices
34+
35+
4. To write new IAM policy run the following command:
36+
37+
gcloud organizations set-iam-policy ORGANIZATION_ID /tmp/org_policy.yaml
38+
gcloud resource-manager folders set-iam-policy FOLDER_ID /tmp/folder_policy.yaml
39+
gcloud projects set-iam-policy PROJECT_ID /tmp/project_policy.yaml
40+
`,
41+
references: [
42+
'https://cloud.google.com/logging/docs/audit/',
43+
'https://cloud.google.com/logging/docs/audit/configure-data-access',
44+
'https://cloud.google.com/sdk/gcloud/reference/projects/get-iam-policy',
45+
],
46+
gql: `{
47+
querygcpIamPolicy{
48+
id
49+
__typename
50+
auditConfigs {
51+
auditLogConfigs {
52+
logType
53+
}
54+
}
55+
}
56+
}`,
57+
resource: 'querygcpIamPolicy[*]',
58+
severity: 'medium',
59+
conditions: {
60+
path: '@.auditConfigs',
61+
array_all: {
62+
and: [
63+
{
64+
path: '[*].auditLogConfigs',
65+
array_any: {
66+
path: '[*].logType',
67+
equal: 'DATA_WRITE',
68+
},
69+
},
70+
{
71+
path: '[*].auditLogConfigs',
72+
array_any: {
73+
path: '[*].logType',
74+
equal: 'DATA_READ',
75+
},
76+
},
77+
],
78+
},
79+
},
80+
}

‎src/gcp/nist-800-53-rev4/rules/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@ import Gcp_NIST_800_53_37 from './gcp-nist-800-53-rev4-3.7'
1818
import Gcp_NIST_800_53_38 from './gcp-nist-800-53-rev4-3.8'
1919
import Gcp_NIST_800_53_39 from './gcp-nist-800-53-rev4-3.9'
2020
import Gcp_NIST_800_53_310 from './gcp-nist-800-53-rev4-3.10'
21+
import Gcp_NIST_800_53_311 from './gcp-nist-800-53-rev4-3.11'
2122
import Gcp_NIST_800_53_41 from './gcp-nist-800-53-rev4-4.1'
2223
import Gcp_NIST_800_53_42 from './gcp-nist-800-53-rev4-4.2'
2324
import Gcp_NIST_800_53_51 from './gcp-nist-800-53-rev4-5.1'
@@ -55,6 +56,7 @@ export default [
5556
Gcp_NIST_800_53_38,
5657
Gcp_NIST_800_53_39,
5758
Gcp_NIST_800_53_310,
59+
Gcp_NIST_800_53_311,
5860
Gcp_NIST_800_53_41,
5961
Gcp_NIST_800_53_42,
6062
Gcp_NIST_800_53_51,

‎src/gcp/nist-800-53-rev4/tests/nist-800-53-rev4-3.x.test.ts‎

Lines changed: 74 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ import Gcp_NIST_800_53_37 from '../rules/gcp-nist-800-53-rev4-3.7'
1111
import Gcp_NIST_800_53_38 from '../rules/gcp-nist-800-53-rev4-3.8'
1212
import Gcp_NIST_800_53_39 from '../rules/gcp-nist-800-53-rev4-3.9'
1313
import Gcp_NIST_800_53_310 from '../rules/gcp-nist-800-53-rev4-3.10'
14+
import Gcp_NIST_800_53_311 from '../rules/gcp-nist-800-53-rev4-3.11'
1415
import { initRuleEngine } from '../../../utils/test'
1516

1617
export interface DatabaseFlagsItem {
@@ -70,13 +71,13 @@ export interface QuerygcpProject {
7071

7172
export interface AuditLogConfig {
7273
logType: string
73-
exemptedMembers: string[]
74+
exemptedMembers?: string[]
7475
}
7576

7677
export interface AuditConfig {
7778
auditLogConfigs: AuditLogConfig[]
78-
service: string
79-
exemptedMembers: string[]
79+
service?: string
80+
exemptedMembers?: string[]
8081
}
8182

8283
export interface QuerygcpIamPolicy {
@@ -968,4 +969,74 @@ describe('GCP NIST 800-53: Rev. 4', () => {
968969
await testRule(subnets, Result.FAIL)
969970
})
970971
})
972+
973+
describe('GCP NIST 3.11 IAM default audit log config should include \'DATA_READ\' and \'DATA_WRITE\' log types', () => {
974+
const testRule = async (
975+
auditConfigs: AuditConfig[],
976+
expectedResult: Result
977+
): Promise<void> => {
978+
// Arrange
979+
const data: NIST3xQueryResponse = {
980+
querygcpIamPolicy: [
981+
{
982+
id: cuid(),
983+
auditConfigs,
984+
},
985+
],
986+
}
987+
988+
// Act
989+
const [processedRule] = await rulesEngine.processRule(
990+
Gcp_NIST_800_53_311 as Rule,
991+
{ ...data }
992+
)
993+
994+
// Asserts
995+
expect(processedRule.result).toBe(expectedResult)
996+
}
997+
998+
test('No Security Issue when there is a auditConfig with logtype set to DATA_WRITE and DATA_READ for all services, and exemptedMembers is empty', async () => {
999+
const data: AuditConfig[] = [
1000+
{
1001+
auditLogConfigs: [
1002+
{
1003+
logType: 'DATA_WRITE',
1004+
},
1005+
{
1006+
logType: 'DATA_READ',
1007+
},
1008+
],
1009+
},
1010+
]
1011+
1012+
await testRule(data, Result.PASS)
1013+
})
1014+
test('Security Issue when there is a auditConfig without logtype set to DATA_WRITE', async () => {
1015+
const data: AuditConfig[] = [
1016+
{
1017+
auditLogConfigs: [
1018+
1019+
{
1020+
logType: 'DATA_READ',
1021+
},
1022+
],
1023+
},
1024+
]
1025+
1026+
await testRule(data, Result.FAIL)
1027+
})
1028+
test('Security Issue when there is a auditConfig without logtype set to DATA_READ', async () => {
1029+
const data: AuditConfig[] = [
1030+
{
1031+
auditLogConfigs: [
1032+
{
1033+
logType: 'DATA_WRITE',
1034+
},
1035+
],
1036+
},
1037+
]
1038+
1039+
await testRule(data, Result.FAIL)
1040+
})
1041+
})
9711042
})

0 commit comments

Comments
 (0)