GKE clusters should have logging enabled
This control ensures that GKE clusters logging is enabled. Kubernetes Engine Clusters must have Stackdriver Logging enabled. The attribute `logging_service` must be defined and different from `none`.
StackDriver logging provides a useful interface to all of stdout/stderr for each container and should be enabled for moitoring, debugging, etc.
What this control checks
GKE clusters must have Stackdriver Logging enabled (logging_service not none).
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.kubernetes_cluster_logging_enabled.
Scans of the Terraform code that flag the same setting before deployment: Checkov check CKV_GCP_1; KICS query "Stackdriver Logging Disabled" (4c7ebcb2-eae2-461e-bc83-456ee2d4f694); Trivy check GCP-0060.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
gcp_kubernetes_cluster_logging_enabled - Checkov Check:
CKV_GCP_1 - Powerpipe Control:
gcp_compliance.control.kubernetes_cluster_logging_enabled - KICS Query:
4c7ebcb2-eae2-461e-bc83-456ee2d4f694 - Trivy Check:
GCP-0060
Last reviewed: 2026-10-09