A cloud engineer needs to export application error logs from a Google Cloud project to an analytics team's BigQuery dataset located in a different project. The engineer configures a Cloud Logging Log Router sink with a BigQuery destination. What step must be completed to allow the sink to successfully write log entries to the destination dataset using least-privilege security practices?
- Grant the BigQuery Data Editor role to the unique writer identity service account generated by the Log Router sink on the target BigQuery dataset.Answer
- BAssign the Project Owner primitive role to the default Compute Engine service account at the source project level.
- CEnable the Cloud Logging API in the target BigQuery project rather than the source project generating the log entries.
- DRevoke BigQuery permissions at the target project level, assuming that folder-level IAM deny policies will automatically allow sink exports.
Answer
Grant the BigQuery Data Editor role to the unique writer identity service account generated by the Log Router sink on the target BigQuery dataset.
When configuring a Cloud Logging Log Router sink to export logs to a resource in another project (such as a BigQuery dataset), Cloud Logging generates a unique service account known as the sink's writer identity. To allow log ingestion, the administrator must grant this specific writer identity the appropriate predefined role (BigQuery Data Editor) directly on the destination dataset.
Step-by-Step Solution
Key Concept
Log Router Sink Writer Identity and Cross-Project IAM Configuration