Issue

When trying to ingest GCP logs to Panther using Google Cloud Storage as the data transport method, the log source remains stuck in Waiting for data status even though no errors were shown during log source creation in Panther and the Health tab of the log source doesn't contain any error messages. I have used Workload Identity Federation for the authentication method.

Resolution

To resolve this issue:

1. Navigate to your affected GCS bucket in the Google Cloud Console

2. Click on the "Permissions" tab

3. Under "Access Control", switch to "Uniform" to enable Uniform Bucket-Level Access (UBLA)

Alternatively, if you prefer to recreate the bucket, select "Access control: Uniform" during bucket creation.

Once UBLA is enabled, the Workload Identity Federation (WIF) token that Panther uses will be accepted by GCS and log ingestion should begin working immediately.

Cause

This issue occurs when the GCS bucket does not have Uniform Bucket-Level Access (UBLA) enabled. During your setup, you selected Workload Identity Federation (WIF) for authentication, which requires UBLA to be enabled on the bucket.