Control: GCP > CIS v5.0 > 2 - Logging and Monitoring > 2.02 - Ensure Google Workspace/Cloud Identity Data Sharing with Google Cloud is Enabled for Admin Audit Logging

Configures auditing against a CIS Benchmark item.

Level: 1

Google Workspace and Cloud Identity maintain audit logs for administrative actions, such as user creation, password changes, and modifications to security settings. By default, these logs are only available within the Google Admin Console.

Enabling the "Sharing of data with Google Cloud Services" setting allows these logs to flow into the Google Cloud (GCP) Organization's Cloud Logging. This is critical for centralized security monitoring, long-term log retention, and the creation of automated alerts for high-risk identity events like privilege escalation.

Resource Types

This control targets the following resource types:

GCP > Organization

Policies

This control type relies on these other policies when running actions:

In Your Workspace

Developers

Control Type URI

tmod:@turbot/gcp-cisv5-0#/control/types/r0202

Category URI

tmod:@turbot/cis#/control/categories/v070602

GraphQL

query controlType(id: "tmod:@turbot/gcp-cisv5-0#/control/types/r0202") { … }

query controls(filter: "controlTypeId:'tmod:@turbot/gcp-cisv5-0#/control/types/r0202'") { … }

CLI

Get Controls

turbot graphql controls --filter "controlTypeId:tmod:@turbot/gcp-cisv5-0#/control/types/r0202"