Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A platform team lead needs to grant a Site Reliability Engineering (SRE) team member permission to view standard Admin Activity audit logs in Cloud Logging for a GCP project. The team member must not be allowed to view Data Access audit logs containing sensitive information, nor should they be able to create log sinks or modify logging configurations. Following Google Cloud's principle of least privilege, which IAM role should be assigned to the team member?

  1. Logs Viewer (roles/logging.viewer)Answer
  2. B
    Viewer (roles/viewer)
  3. C
    Private Logs Viewer (roles/logging.privateLogViewer)
  4. D
    Logging Admin (roles/logging.admin)

Answer

Logs Viewer (roles/logging.viewer)
The Logs Viewer role (roles/logging.viewer) provides read-only permissions to view standard logs, including Admin Activity audit logs, but does not grant access to private logs (Data Access audit logs) or administrative permissions to modify log routing sinks.

Step-by-Step Solution

1
Analyze the access requirement
The user needs to view standard Admin Activity audit logs only.
Admin Activity logs record API calls or admin actions modifying resource configurations.
2
Evaluate restrictions against candidate roles
Access must explicitly exclude private Data Access logs and configuration permissions like log sink creation.
Principle of least privilege dictates granting only the minimum necessary permissions for the role.
3
Select the appropriate predefined IAM role
Logs Viewer (roles/logging.viewer) grants access to standard logs and Admin Activity logs while excluding private logs and admin actions.
This precisely matches the security requirement without over-privileging the user.

Key Concept

IAM Roles for Viewing Cloud Audit Logs under Least Privilege
Estimated Time:1m 30s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic