Examkin

Question

Difficulty: HardMonitoring and Logging

An enterprise organization uses a multi-project structure in Google Cloud. A Cloud Engineer sets up an organization-level aggregated Log Router sink to export all Cloud Audit logs from all projects to a BigQuery dataset hosted in a dedicated security telemetry project (proj-sec-logs). After configuring the sink filter and destination, the engineer observes that audit logs are not populating the target BigQuery tables. What step must the engineer perform to ensure logs are successfully delivered to BigQuery?

  1. Grant the unique Writer Identity service account generated by the sink the BigQuery Data Editor role on the destination dataset.Answer
  2. B
    Grant the Organization Administrator primitive role to the default Compute Engine service account at the root organization node.
  3. C
    Enable the Cloud Logging API at the Organization resource level instead of individual project settings.
  4. D
    Rely on organization IAM policy inheritance to automatically grant BigQuery write access to all child project log writers.

Answer

Grant the unique Writer Identity service account generated by the sink the BigQuery Data Editor role on the destination dataset.
When a Log Router sink routes logs to a destination in another project (such as a BigQuery dataset in a central security project), Google Cloud creates a unique service account called a Writer Identity for that sink. To complete log delivery, that Writer Identity service account must be granted appropriate write permissions (such as BigQuery Data Editor) directly on the target dataset.

Step-by-Step Solution

1
Identify the service account identity associated with the Log Router sink.
When a Log Router sink is created (especially cross-project or aggregated sinks), Google Cloud assigns a unique Writer Identity (service account email address) to the sink.
Log sink operations execute using dedicated service identities to ensure secure and auditable log delivery.
2
Determine the destination permissions required for BigQuery ingestion.
Writing entries into a BigQuery dataset requires the BigQuery Data Editor (roles/bigquery.dataEditor) role on the destination dataset.
Log Router sinks require dataset-level write access to insert incoming log records into tables.
3
Apply IAM role binding to the sink's Writer Identity on the destination BigQuery dataset.
The sink Writer Identity obtains authorization to create and append table data in the destination security project.
Explicit IAM role assignment on the destination dataset resolves authorization failures during log routing.

Key Concept

Cross-Project Log Router Sink Ingestion and Writer Identity Authorization
Estimated Time:2m 0s
Rate this question

Topics

Monitoring and Logging

More questions from this topic