gcp-logging-audit-config-disable

Modify the project, folder, or org IAM policy's auditConfigs to remove DATA_READ/DATA_WRITE log types, suppressing Data Access audit log generation for targeted GCP services at the IAM policy level.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'resource': None}

where

node_type(?resource) in [Project, Organization, Folder] effective_action(?principal, ?resource) includes any of ['resourcemanager.projects.setIamPolicy', 'resourcemanager.organizations.setIamPolicy', 'resourcemanager.folders.setIamPolicy'] the setIamPolicy call can modify the auditConfigs field (not just bindings[]) — remove service entries or DATA_READ/DATA_WRITE logTypes Data Access logging was previously ENABLED for the affected service(s) — disabling a never-enabled auditConfig is a no-op

emit

source type	`Identity`
target type	`Project`
source	`?principal`
target	`?resource`
permissions	`resourcemanager.projects.setIamPolicy` `resourcemanager.organizations.setIamPolicy` `resourcemanager.folders.setIamPolicy`
conditions	`iam_permission`
state logic	ACTIVE if the principal holds EFFECTIVE resourcemanager.*.setIamPolicy (at project/org/folder scope) and the auditConfig for one or more services includes DATA_READ or DATA_WRITE log types that the principal can remove; CONDITIONAL(service_state) if Data Access log types for the targeted service were never enabled (evasion would be a no-op); BLOCKED under an IAM deny policy or org policy restricting setIamPolicy.

Narrative

{principal.name} can modify the IAM policy auditConfigs (resourcemanager.*.setIamPolicy) to remove DATA_READ/DATA_WRITE entries for targeted services at project/org/folder scope, silently disabling Data Access audit log generation - eliminating the forensic record of read/write API calls against GCS, BigQuery, Secret Manager, and other audited services. This does not affect Admin Activity or System Event logs (_Required), which are always generated.

Raw rule rules/derived/gcp/logging.yaml

id: gcp-logging-audit-config-disable
emits: CanModifyConfiguration
description: Modify the project, folder, or org IAM policy's auditConfigs to remove DATA_READ/DATA_WRITE
  log types, suppressing Data Access audit log generation for targeted GCP services at the IAM policy
  level.
match:
- - principal: null
  - HasPermission
  - resource: null
where:
- node_type(?resource) in [Project, Organization, Folder]
- effective_action(?principal, ?resource) includes any of ['resourcemanager.projects.setIamPolicy', 'resourcemanager.organizations.setIamPolicy',
  'resourcemanager.folders.setIamPolicy']
- "the setIamPolicy call can modify the auditConfigs field (not just bindings[]) \u2014 remove service\
  \ entries or DATA_READ/DATA_WRITE logTypes"
- "Data Access logging was previously ENABLED for the affected service(s) \u2014 disabling a never-enabled\
  \ auditConfig is a no-op"
emit:
  source_type: Identity
  target_type: Project
  source: ?principal
  target: ?resource
  permissions:
  - resourcemanager.projects.setIamPolicy
  - resourcemanager.organizations.setIamPolicy
  - resourcemanager.folders.setIamPolicy
  conditions:
  - iam_permission
  state_logic: ACTIVE if the principal holds EFFECTIVE resourcemanager.*.setIamPolicy (at project/org/folder
    scope) and the auditConfig for one or more services includes DATA_READ or DATA_WRITE log types that
    the principal can remove; CONDITIONAL(service_state) if Data Access log types for the targeted service
    were never enabled (evasion would be a no-op); BLOCKED under an IAM deny policy or org policy restricting
    setIamPolicy.
  confidence: 0.88
  derived_from:
  - HasPermission(?principal, resourcemanager.*.setIamPolicy, ?resource) + auditConfigs mutation scope
  false_positive_note: "CRITICAL SCOPING: not all setIamPolicy calls touch auditConfigs \u2014 a call\
    \ that modifies only bindings[] without changing auditConfigs[] does NOT suppress logs. Emit only\
    \ when the effective call can write the auditConfigs field. Also: Admin Activity and System Event\
    \ logs (_Required) are ALWAYS generated regardless of auditConfig; only DATA_READ / DATA_WRITE / POLICY_DENIED\
    \ Data Access log types are gated by auditConfigs. Data Access audit logging is opt-in by default;\
    \ if never enabled for a service, this is a no-op evasion. This is detective-control weakening only\
    \ \u2014 setIamPolicy also triggers CanGrantPermission (per identity-escalation.yaml); those are separate,\
    \ independently modeled edges. Never chain this evasion edge to privilege escalation."
  narrative: "{principal.name} can modify the IAM policy auditConfigs (resourcemanager.*.setIamPolicy)\
    \ to remove DATA_READ/DATA_WRITE entries for targeted services at project/org/folder scope, silently\
    \ disabling Data Access audit log generation \u2014 eliminating the forensic record of read/write\
    \ API calls against GCS, BigQuery, Secret Manager, and other audited services. This does not affect\
    \ Admin Activity or System Event logs (_Required), which are always generated."