# GCP - Logging Enum

{{#include ../../../banners/hacktricks-training.md}}

## Basic Information

This service allows users to store, search, analyze, monitor, and alert on **log data and events** from GCP.

Cloud Logging is fully integrated with other GCP services, providing a centralized repository for logs from all your GCP resources. It **automatically collects logs from various GCP services** like App Engine, Compute Engine, and Cloud Functions. You can also use Cloud Logging for applications running on-premises or in other clouds by using the Cloud Logging agent or API.

Key Features:

- **Log Data Centralization:** Aggregate log data from various sources, offering a holistic view of your applications and infrastructure.
- **Real-time Log Management:** Stream logs in real time for immediate analysis and response.
- **Powerful Data Analysis:** Use advanced filtering and search capabilities to sift through large volumes of log data quickly.
- **Integration with BigQuery:** Export logs to BigQuery for detailed analysis and querying.
- **Log-based Metrics:** Create custom metrics from your log data for monitoring and alerting.

### Logs flow

<figure><img src="../../../images/image (3) (1) (1).png" alt=""><figcaption><p><a href="https://betterstack.com/community/guides/logging/gcp-logging/">https://betterstack.com/community/guides/logging/gcp-logging/</a></p></figcaption></figure>

Basically the sinks and log based metrics will device where a log should be stored.

### Configurations Supported by GCP Logging

Cloud Logging is highly configurable to suit diverse operational needs:

1. **Log Buckets (Logs storage in the web):** Define buckets in Cloud Logging to manage **log retention**, providing control over how long your log entries are retained.
   - By default the buckets `_Default` and `_Required` are created (one is logging what the other isn’t).
     - **\_Required** is:

````
     ```bash
     LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
     ```

````

- **Retention period** of the data is configured per bucket and must be **at least 1 day.** However the **retention period of \_Required is 400 days** and cannot be modified.
- Note that Log Buckets are **not visible in Cloud Storage.**

2. **Log Sinks (Log router in the web):** Create sinks to **export log entries** to various destinations such as Pub/Sub, BigQuery, or Cloud Storage based on a **filter**.
   - By **default** sinks for the buckets `_Default` and `_Required` are created:
   - ```bash
     _Required  logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Required  LOG_ID("cloudaudit.googleapis.com/activity") OR LOG_ID("externalaudit.googleapis.com/activity") OR LOG_ID("cloudaudit.googleapis.com/system_event") OR LOG_ID("externalaudit.googleapis.com/system_event") OR LOG_ID("cloudaudit.googleapis.com/access_transparency") OR LOG_ID("externalaudit.googleapis.com/access_transparency")
     _Default   logging.googleapis.com/projects/<proj-name>/locations/global/buckets/_Default   NOT LOG_ID("cloudaudit.googleapis.com/activity") AND NOT LOG_ID("externalaudit.googleapis.com/activity") AND NOT LOG_ID("cloudaudit.googleapis.com/system_event") AND NOT LOG_ID("externalaudit.googleapis.com/system_event") AND NOT LOG_ID("cloudaudit.googleapis.com/access_transparency") AND NOT LOG_ID("externalaudit.googleapis.com/access_transparency")
     ```
   - **Exclusion Filters:** It's possible to set up **exclusions to prevent specific log entries** from being ingested, saving costs, and reducing unnecessary noise.
3. **Log-based Metrics:** Configure **custom metrics** based on the content of logs, allowing for alerting and monitoring based on log data.
4. **Log views:** Log views give advanced and **granular control over who has access** to the logs within your log buckets.
   - Cloud Logging **automatically creates the `_AllLogs` view for every bucket**, which shows all logs. Cloud Logging also creates a view for the `_Default` bucket called `_Default`. The `_Default` view for the `_Default` bucket shows all logs except Data Access audit logs. The `_AllLogs` and `_Default` views are not editable.

It's possible to allow a principal **only to use a specific Log view** with an IAM policy like:

```json
{
  "bindings": [
    {
      "members": ["user:username@gmail.com"],
      "role": "roles/logging.viewAccessor",
      "condition": {
        "title": "Bucket reader condition example",
        "description": "Grants logging.viewAccessor role to user username@gmail.com for the VIEW_ID log view.",
        "expression": "resource.name == \"projects/PROJECT_ID/locations/LOCATION/buckets/BUCKET_NAME/views/VIEW_ID\""
      }
    }
  ],
  "etag": "BwWd_6eERR4=",
  "version": 3
}
```

### Default Logs

By default **Admin Write** operations (also called Admin Activity audit logs) are the ones logged (write metadata or configuration information) and **can't be disabled**.

Then, the user can enable **Data Access audit logs**, these are **Admin Read, Data Write and Data Write**.

You can find more info about each type of log in the docs: [https://cloud.google.com/iam/docs/audit-logging](https://cloud.google.com/iam/docs/audit-logging)

However, note that this means that by default **`GetIamPolicy`** actions and other read actions are **not being logged**. So, by default an attacker trying to enumerate the environment won't be caught if the sysadmin didn't configure to generate more logs.

To enable more logs in the console the sysadmin needs to go to [https://console.cloud.google.com/iam-admin/audit](https://console.cloud.google.com/iam-admin/audit) and enable them. There are 2 different options:

- **Default Configuration**: It's possible to create a default configuration and log all the Admin Read and/or Data Read and/or Data Write logs and even add exempted principals:

<figure><img src="../../../images/image (338).png" alt=""><figcaption></figcaption></figure>

- **Select the services**: Or just **select the services** you would like to generate logs and the type of logs and the excepted principal for that specific service.

Also note that by default only those logs are being generated because generating more logs will increase the costs.

### Enumeration

The `gcloud` command-line tool is an integral part of the GCP ecosystem, allowing you to manage your resources and services. Here's how you can use `gcloud` to manage your logging configurations and access logs.

```bash
# List buckets
gcloud logging buckets list
gcloud logging buckets describe <bucket-name> --location <location>

# List log entries: only logs that contain log entries are listed.
gcloud logging logs list

# Get log metrics
gcloud logging metrics list
gcloud logging metrics describe <metric-name>

# Get log sinks
gcloud logging sinks list
gcloud logging sinks describe <sink-name>

# Get log views
gcloud logging views list --bucket <bucket> --location global
gcloud logging views describe --bucket <bucket> --location global <view-id> # view-id is usually the same as the bucket name

# Get log links
gcloud logging links list --bucket _Default --location global
gcloud logging links describe <link-id> --bucket _Default --location global
```

Example to check the logs of **`cloudresourcemanager`** (the one used to BF permissions): [https://console.cloud.google.com/logs/query;query=protoPayload.serviceName%3D%22cloudresourcemanager.googleapis.com%22;summaryFields=:false:32:beginning;cursorTimestamp=2024-01-20T00:07:14.482809Z;startTime=2024-01-01T11:12:26.062Z;endTime=2024-02-02T17:12:26.062Z?authuser=2\&project=digital-bonfire-410512](https://console.cloud.google.com/logs/query;query=protoPayload.serviceName%3D%22cloudresourcemanager.googleapis.com%22;summaryFields=:false:32:beginning;cursorTimestamp=2024-01-20T00:07:14.482809Z;startTime=2024-01-01T11:12:26.062Z;endTime=2024-02-02T17:12:26.062Z?authuser=2&project=digital-bonfire-410512)

There aren't logs of **`testIamPermissions`**:

<figure><img src="../../../images/image (2) (1) (1) (1).png" alt=""><figcaption></figcaption></figure>

### Post Exploitation

{{#ref}}
../gcp-post-exploitation/gcp-logging-post-exploitation.md
{{#endref}}

### Persistence

{{#ref}}
../gcp-persistence/gcp-logging-persistence.md
{{#endref}}

## References

- [https://cloud.google.com/logging/docs/logs-views#gcloud](https://cloud.google.com/logging/docs/logs-views#gcloud)
- [https://betterstack.com/community/guides/logging/gcp-logging/](https://betterstack.com/community/guides/logging/gcp-logging/)

{{#include ../../../banners/hacktricks-training.md}}



