Cloud Storage buckets should have usage and storage logs enabled
Google Cloud Storage buckets are evaluated to ensure that Usage and Storage Logs are enabled. Enabling these logs provides detailed visibility into access requests, usage patterns, and storage activity within each bucket.
Buckets without Usage and Storage Logs enabled lack visibility into access and storage activity, which increases the risk of undetected data exfiltration, misuse, or configuration errors.
What this control checks
Checks that each Cloud Storage bucket has a logging configuration
Common pitfalls
Missing logging.logBucket counts as disabled
Buckets missing the 'logging.logBucket' configuration are treated as having Usage and Storage Logs disabled.
Unknown log_bucket value gives an unknown result
# log_bucket is a computed/unknown value (e.g. at terraform plan time)
Audit evidence
Evidence that deployed resources meet this control: Prowler check cloudstorage_bucket_logging_enabled (prowler gcp --checks cloudstorage_bucket_logging_enabled).
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_62; KICS query "Cloud Storage Bucket Logging Not Enabled" (d6cabc3a-d57e-48c2-b341-bf3dd4f4a120).
Related controls
- Cloud Storage buckets used for exporting logs should have object versioning enabled
- Cloud Storage buckets should have uniform bucket-level access enabled
- Cloud Storage buckets should have Bucket Only Policy enabled
- HTTP(S) load balancers should have logging enabled
- VPC subnets should all have VPC Flow Logs enabled
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_cloudstorage_bucket_logging_enabled - Checkov Check:
CKV_GCP_62 - Prowler Check:
cloudstorage_bucket_logging_enabled - KICS Query:
d6cabc3a-d57e-48c2-b341-bf3dd4f4a120
Last reviewed: 2026-10-09