Examkin

Question

Difficulty: Very hardViewing and Analyzing Cloud Audit Logs

An enterprise auditor needs to review both Admin Activity and Data Access audit logs for Cloud Storage buckets across all projects within a specific GCP Folder. The auditor must be able to view sensitive Data Access logs containing user access records, but must not be granted permissions to view the actual data stored inside the buckets or modify any Cloud Logging routing configurations. Following Google Cloud security best practices, which IAM role assignment satisfies these requirements with least privilege?

  1. Grant the Logs Private Logs Viewer role (roles/logging.privateLogViewer) on the target Folder.Answer
  2. B
    Grant the Logs Viewer role (roles/logging.viewer) on the target Folder.
  3. C
    Grant the Viewer primitive role (roles/viewer) on the target Folder.
  4. D
    Grant the Logging Admin role (roles/logging.admin) on the target Folder.

Answer

Granting the Logs Private Logs Viewer predefined role (roles/logging.privateLogViewer) at the Folder level provides read access to both standard audit logs (Admin Activity) and restricted Data Access audit logs across all inherited child projects without providing access to actual underlying storage payload data or log administration capabilities.
The correct answer specifies granting the Logs Private Logs Viewer role (roles/logging.privateLogViewer) at the Folder level. Cloud Logging categorizes Data Access logs under private logs. While roles/logging.viewer only allows viewing Admin Activity, System Event, and Access Transparency logs, roles/logging.privateLogViewer grants access to Data Access logs as well. Furthermore, it does not grant permissions to read actual object contents stored in Cloud Storage or modify logging sinks, adhering strictly to least privilege.

Step-by-Step Solution

1
Identify log access scope requirement
The requirement specifies reading both Admin Activity and Data Access audit logs.
Data Access logs are categorized as private logs in Cloud Logging because they contain detailed information about user interactions with resource data.
2
Evaluate standard viewer vs. private viewer role permissions
roles/logging.viewer lacks permissions to read Data Access logs, whereas roles/logging.privateLogViewer encompasses all permissions of roles/logging.viewer plus permissions to view private Data Access logs.
Google Cloud segregates Data Access audit log visibility behind the private log viewing permission to prevent unauthorized inspection of operational access patterns.
3
Apply least privilege and resource hierarchy inheritance
Assigning roles/logging.privateLogViewer at the Folder level allows inheritance across all underlying projects while withholding data payload access and logging management rights.
Primitive roles grant excessive resource read rights, and admin roles grant management rights, making predefined private log viewer the minimal required grant.

Key Concept

Cloud Audit Logs IAM Access Granularity
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic