Firewall rules should have logging enabled
Firewall rules should have logging enabled. This control fails if logging is disabled for firewall rule. The powerpipe check is titled "Ensure compute firewall rule have logging enabled".
What this control checks
Fails if logging is disabled for a firewall rule.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.compute_firewall_rule_logging_enabled.
Framework-specific interpretation
NIST Cybersecurity Framework v2.0: Mapped to GV.SC-07 (The risks posed by a supplier, their products and services, and other third parties are understood, recorded...), PR.IR-01 (Networks and environments are protected from unauthorized logical access and usage.) and PR.PS-04 (Log records are generated and made available for continuous monitoring.).
Framework mappings
The clauses this control is mapped to in each framework.
NIST Cybersecurity Framework v2.0
- GV.SC-07: The risks posed by a supplier, their products and services, and other third parties are understood, recorded, prioritized, assessed, responded to, and monitored over the course of the relationship.
- PR.IR-01
- PR.PS-04
- 10.1 Implement audit trails to link all access to system components to each individual user
- Through interviews of responsible personnel, observation of audit logs, and examination of audit log settings
Related controls
- HTTP(S) load balancers should have logging enabled
- Firewall rules without specific targets should prohibit ingress from 0.0.0.0/0 to any port
- Firewall rules should prohibit unrestricted SSH access from the internet
- Projects should have Cloud Audit Logs properly configured across all services and all users
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
compute_firewall_rule_logging_enabled - Powerpipe Control:
gcp_compliance.control.compute_firewall_rule_logging_enabled
Last reviewed: 2026-10-09