feat(query): implements "Beta - Logs And Alerts Missing Audit Configuration Changes"

[cx-andre-pereira]

Reason for Proposed Changes

• Currently there are no queries addressing the Terraform/gcp "google_logging_metric" and "google_monitoring_alert_policy" resources's "filter" fields. This query is meant to ensure those resources's filters properly check for admin activity and data access logs.

• Quoting CIS_Google_Cloud_Platform_Foundation_Benchmark_v4.0.0 page 86: "Admin activity and data access logs produced by cloud audit logging enable security analysis, resource change tracking, and compliance auditing. Configuring the metric filter and alerts for audit configuration changes ensures the recommended state of audit configuration is maintained so that all activities in the project are audit-able at any point in time."

• Additionally page 86 states the specific filter that should be present :

protoPayload.methodName="SetIamPolicy" AND
protoPayload.serviceData.policyDelta.auditConfigDeltas:*

Proposed Changes

• Developed an initial implementation for a query that ensures "Audit Configuration Changes" are accounted for by a given filter.

• Based on the audit described by the CIS entry the query will flag if :

  • There is at least one"google_logging_metric" resource in the project and none contain the correct filter
  • There is at least one "google_monitoring_alert_policy" resource in the project and none contain the filter/reference a logging metric that contains the correct filter
  • There is at least one "google_monitoring_alert_policy" resource that contains the filter but none of them declare "notification_channels".

Note: there are currently issues with the search values, i could not get them to point to the "filter" field for either of the target resources in the scan results.

Tenable Reference

I submit this contribution under the Apache-2.0 license.

[github-actions]

KICS version: v2.1.13

Category Results CRITICAL 0 HIGH 0 MEDIUM 0 LOW 0 INFO 0 TRACE 0 TOTAL 0	Metric Values Files scanned 1 Files parsed 1 Files failed to scan 0 Total executed queries 47 Queries failed to execute 0 Execution time 0