lacework-global-489

info

This rule has been split and is linked to lacework-global-246. See Adjusted Rules for CIS GCP 1.3.0 for further details.

2.2 Ensure That Sink Destinations Exist (Automated)

Description

Best practices recommend that the resource configured as a log sink destination exists.

Remediation

From Console:

1. Go to Logs Router by visiting https://console.cloud.google.com/logs/router.
2. Click the three dots next to the sink with a non-existent destination.
3. Click Edit sink.
4. Under Sink destination, select a sink service and a destination resource.
5. Click Done.
6. Click Update Sink.

For more information, see https://cloud.google.com/logging/docs/export/configure_export_v2#dest-create.

note

Ensure that the sink filter is not left empty. Create a filter to collect only the relevant logs.

From Command Line:

To update a sink with a new destination:

gcloud logging sinks create <sink-name> <destination-name>

References

https://cloud.google.com/logging/docs/reference/tools/gcloud-logging
https://cloud.google.com/logging/quotas
https://cloud.google.com/logging/docs/routing/overview
https://cloud.google.com/logging/docs/export/using_exported_logs
https://cloud.google.com/logging/docs/export/configure_export_v2
https://cloud.google.com/logging/docs/export/aggregated_exports
https://cloud.google.com/sdk/gcloud/reference/beta/logging/sinks/list
https://cloud.google.com/logging/docs/export/configure_export_v2#restore_the_default_sink_filter