Cloud Functions should have permissions to disrupt logging restricted
The control `cloudfunction_function_no_disrupt_logging_permission` is titled "Cloudfunction functions should restrict disrupt logging permission". It ensures that a Cloudfunction function does not disrupt logging permissions.
What this control checks
Cloudfunction function does not disrupt logging permissions
Common pitfalls
Query selects roles where not is_gcp_managed
The query selects roles where not is_gcp_managed and the permission is one of 'logging.buckets.delete', 'logging.buckets.update', 'logging.logMetrics.delete', 'logging.logMetrics.update', 'logging.logs.delete', 'logging.sinks.delete', 'logging.sinks.update'.
Bindings matched on bucketWriter, configWriter, admin
The policy bindings are matched on the roles 'roles/logging.bucketWriter', 'roles/logging.configWriter' and 'roles/logging.admin'.
Audit evidence
Evidence that deployed resources meet this control: PowerPipe control gcp_compliance.control.cloudfunction_function_no_disrupt_logging_permission.
Related controls
Tool mappings
Use these identifiers to cross-reference this control across tools, reports, and evidence.
- Compliance.tf Control:
cloudfunction_function_no_disrupt_logging_permission - Powerpipe Control:
gcp_compliance.control.cloudfunction_function_no_disrupt_logging_permission
Last reviewed: 2026-10-09