Review Cloud Storage bucket logging

Description

A bucket’s logging configuration delivers usage and storage logs as files in another bucket. This is separate from Cloud Audit Logs; omission of the block does not mean all access records are absent. Generally consider Cloud Audit Logs first for API-operation auditing.

Potential impact

Investigating unusual requests and failures can be harder if required records are also absent from other systems.
Usage-log delivery is not guaranteed to be complete or timely and does not replace real-time alerting.

Remediation

Configure required Cloud Audit Logs and Data Access records. When usage logs are needed, such as for public-object access, configure logging.log_bucket and delivery permissions.
Check the destination bucket’s location, organization and security-perimeter requirements, and grant the cloud-storage-analytics@google.com group the required object-creation permission. Verify receipt, retention and read access.

Examples

Use available bucket names and prepare the logging bucket separately. The original force_destroy = true permits Terraform deletion even when objects remain, so assess it separately before production use.

Before

hcl

resource "google_storage_bucket" "example" {
  name          = "auto-expiring-bucket"
  location      = "US"
  force_destroy = true
}

After

hcl

resource "google_storage_bucket" "example" {
  name          = "auto-expiring-bucket"
  location      = "US"
  force_destroy = true

  logging {
    log_bucket = "example-logs-bucket"
  }
}

Explanation:

Before: File-based log delivery is not configured here. Check other audit-log settings separately.
After: A destination is specified for file-based logs. The bucket, permissions and actual delivery still need verification.