A cloud operations engineer creates a custom Log Router sink in Cloud Logging to export critical application logs from a production project to a Pub/Sub topic in a centralized security project. After creating the sink, the engineer observes that log entries are not arriving in the destination topic. Which action must the engineer perform to resolve this issue?
- Grant the service account writer identity generated by the Log Router sink the Pub/Sub Publisher role on the destination Pub/Sub topic.Answer
- BAssign the primitive Editor role to the Compute Engine default service account in the production project.
- CGrant the Pub/Sub Publisher role at the organization resource level to override project-level IAM inheritance restrictions.
- DReplace the installed Ops Agent on the virtual machines with the legacy Stackdriver Logging agent to enable cross-project telemetry forwarding.
Answer
Grant the service account writer identity generated by the Log Router sink the Pub/Sub Publisher role on the destination Pub/Sub topic.
When configuring a Cloud Logging Log Router sink to route logs to a resource (such as a Pub/Sub topic, Cloud Storage bucket, or BigQuery dataset) in another project, Cloud Logging creates a unique service account called a writer identity. To allow log routing, this writer identity must be granted appropriate write permissions (e.g., Pub/Sub Publisher) on the destination resource.
Step-by-Step Solution
Key Concept
Log Router Sink Writer Identity and Cross-Project IAM Permissions