Google Cloud Compliance ControlsGoogle Cloud VPC
Firewall rules should have logging enabled
Firewall rules should have logging enabled. This control fails if logging is disabled for firewall rule. The powerpipe check is titled "Ensure compute firewall rule have logging enabled".
What this control checks
Fails if logging is disabled for a firewall rule.
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- PR.IR-01
- PR.PS-04
- 10.1 Implement audit trails to link all access to system components to each individual user
- Through interviews of responsible personnel, observation of audit logs, and examination of audit log settings
Related controls
- HTTP(S) load balancers should have logging enabled
- Firewall rules without specific targets should prohibit ingress from 0.0.0.0/0 to any port
- Firewall rules should prohibit unrestricted SSH access from the internet
- Projects should have Cloud Audit Logs properly configured across all services and all users
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_logging_enabled - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_logging_enabled
Last reviewed: 2026-10-09