For AI agents: A markdown version of this page is available at https://docs.datadoghq.com/security/code_security/iac_security/iac_rules/ansible-gcp-stackdriver-monitoring-disabled.md. A documentation index is available at /llms.txt.

Stackdriver monitoring disabled

This product is not supported for your selected Datadog site. ().

Metadata

Id: ansible-gcp-stackdriver-monitoring-disabled

Provider: GCP

Platform: Ansible

Severity: Medium

Category: Observability

Learn More

Description

GKE clusters must have Cloud Monitoring (Stackdriver) enabled to provide observability and support timely incident detection and response. Disabling monitoring removes metrics and logs needed for alerting, troubleshooting, and forensic analysis.

For Ansible resources using the google.cloud.gcp_container_cluster or gcp_container_cluster modules, the monitoring_service property must be defined and must not be set to 'none'. Resources that omit monitoring_service or explicitly set monitoring_service: 'none' are flagged.

Secure configuration example:

- name: Create GKE cluster with monitoring enabled
  google.cloud.gcp_container_cluster:
    name: my-cluster
    monitoring_service: monitoring.googleapis.com/kubernetes

Compliant Code Examples

#this code is a correct code for which the query should not find any result
- name: create a cluster
  google.cloud.gcp_container_cluster:
    name: my-cluster
    initial_node_count: 2
    master_auth:
      username: cluster_admin
      password: my-secret-password
    node_config:
      machine_type: n1-standard-4
      disk_size_gb: 500
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: /tmp/auth.pem
    state: present
    monitoring_service: monitoring.googleapis.com

Non-Compliant Code Examples

#this is a problematic code where the query should report a result(s)
- name: create a cluster1
  google.cloud.gcp_container_cluster:
    name: my-cluster1
    initial_node_count: 2
    master_auth:
      username: cluster_admin
      password: my-secret-password
    node_config:
      machine_type: n1-standard-4
      disk_size_gb: 500
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
- name: create a cluster2
  google.cloud.gcp_container_cluster:
    name: my-cluster2
    initial_node_count: 2
    master_auth:
      username: cluster_admin
      password: my-secret-password
    node_config:
      machine_type: n1-standard-4
      disk_size_gb: 500
    location: us-central1-a
    project: test_project
    auth_kind: serviceaccount
    service_account_file: "/tmp/auth.pem"
    state: present
    monitoring_service: none