gcp-logging-delete-default-sink

Delete or disable the _Default log sink, silencing all non-Required audit log delivery for the project - the headline defense-evasion primitive for GCP Cloud Logging.

derived gcp emits CanModifyConfiguration

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

{'principal': None} HasPermission {'sink': None}

where

node_type(?sink) == LoggingService ?sink.provider_type == 'google.logging.v2.LogSink' ?sink.name ends with '/sinks/_Default' (project, folder, or org scope) effective_action(?principal, ?sink) includes any of ['logging.sinks.delete', 'logging.sinks.update'] ?sink is NOT _Required — _Required is system-immutable; API calls targeting it return PERMISSION_DENIED regardless of IAM

emit

source type	`Identity`
target type	`LoggingService`
source	`?principal`
target	`?sink`
permissions	`logging.sinks.delete` `logging.sinks.update`
conditions	`iam_permission`
state logic	ACTIVE when the principal holds EFFECTIVE logging.sinks.delete (removes the sink entirely) OR logging.sinks.update (can set disabled: true, blank the filter, or replace the destination to suppress entries) on the _Default sink, with no IAM deny policy or org policy blocking the action; CONDITIONAL(iam_permission) if the grant is at a broader scope (folder/org) that may not resolve to this project's _Default; BLOCKED if an IAM deny policy (logging.sinks.delete / logging.sinks.update) or org policy constraint blocks the action at the effective scope.

Narrative

{principal.name} can delete or disable the _Default log sink for {project.name} (logging.sinks.delete / logging.sinks.update), silencing Data Access, Policy Denied, and other non-Required audit log delivery - a cover-tracks primitive that reduces detection of subsequent attacker activity in the project. This does not grant resource access.

Raw rule rules/derived/gcp/logging.yaml

id: gcp-logging-delete-default-sink
emits: CanModifyConfiguration
description: "Delete or disable the _Default log sink, silencing all non-Required audit log delivery for\
  \ the project \u2014 the headline defense-evasion primitive for GCP Cloud Logging."
match:
- - principal: null
  - HasPermission
  - sink: null
where:
- node_type(?sink) == LoggingService
- ?sink.provider_type == 'google.logging.v2.LogSink'
- ?sink.name ends with '/sinks/_Default' (project, folder, or org scope)
- effective_action(?principal, ?sink) includes any of ['logging.sinks.delete', 'logging.sinks.update']
- "?sink is NOT _Required \u2014 _Required is system-immutable; API calls targeting it return PERMISSION_DENIED\
  \ regardless of IAM"
emit:
  source_type: Identity
  target_type: LoggingService
  source: ?principal
  target: ?sink
  permissions:
  - logging.sinks.delete
  - logging.sinks.update
  conditions:
  - iam_permission
  state_logic: 'ACTIVE when the principal holds EFFECTIVE logging.sinks.delete (removes the sink entirely)
    OR logging.sinks.update (can set disabled: true, blank the filter, or replace the destination to suppress
    entries) on the _Default sink, with no IAM deny policy or org policy blocking the action; CONDITIONAL(iam_permission)
    if the grant is at a broader scope (folder/org) that may not resolve to this project''s _Default;
    BLOCKED if an IAM deny policy (logging.sinks.delete / logging.sinks.update) or org policy constraint
    blocks the action at the effective scope.'
  confidence: 0.95
  derived_from:
  - HasPermission(?principal, logging.sinks.delete|logging.sinks.update, ?sink=_Default)
  false_positive_note: "Do NOT emit for the _Required sink \u2014 it is system-immutable; no IAM grant\
    \ allows delete or disable of _Required (API returns PERMISSION_DENIED). Only the _Default and custom\
    \ sinks are mutable. logging.sinks.update that changes only a description or label without modifying\
    \ filter, destination, or disabled flag is NOT evasion \u2014 scope to sink-capability-affecting updates.\
    \ This is detective-control weakening only: it reduces detection coverage but does NOT grant access\
    \ to resources, does NOT block downstream edges, and does NOT chain to privilege escalation. Never\
    \ emit CanExecuteAs off this edge. Note that disabling the _Default sink stops future log delivery;\
    \ it does not delete previously stored log bucket entries (use gcp-logging-delete-log-bucket for that).\
    \ _Required sinks (system immutable) must never match this rule; only _Default and custom sinks are\
    \ mutable."
  narrative: "{principal.name} can delete or disable the _Default log sink for {project.name} (logging.sinks.delete\
    \ / logging.sinks.update), silencing Data Access, Policy Denied, and other non-Required audit log\
    \ delivery \u2014 a cover-tracks primitive that reduces detection of subsequent attacker activity\
    \ in the project. This does not grant resource access."