GoogleCloudPlatform / GoogleCloudPlatform/config-validator

IAM Audit log is not included in project level CAI data if it's enabled in org level

Open
#145 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
48
Forks
37
PR merge metrics
No merged PRs in 30d

Description

I have audit log enabled for all services at org level, but violations are still reported by Forseti in CSCC for a lot of projects and folders. I took a look at the CAI export and it seems the project level (probably folder level as well, but I didn't check), the `audit_log_configs` block is not present in the exported data, and I guess that's why it causes the forseti to still report violations.

(note this is not the same issue as https://github.com/forseti-security/policy-library/issues/367). This issue might need to be solved in CAI export data or how config validator collect project/folder level audit log information.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.