Examkin

Question

Difficulty: HardViewing and Analyzing Cloud Audit Logs

A DevOps engineer is investigating a potential data leak from a sensitive BigQuery dataset hosted in project `corp-analytics-prod`. The engineer runs a `gcloud logging read` command to inspect read operations recorded in Cloud Audit Logs. Although the engineer has been granted the Logs Viewer (`roles/logging.viewer`) role at the project level, the command execution returns no log entries for data read operations, returning only system Admin Activity logs. Which IAM role assignment adheres to the principle of least privilege while enabling the engineer to view these Data Access audit logs?

  1. Grant the engineer the Private Logs Viewer (`roles/logging.privateLogViewer`) role on project `corp-analytics-prod`.Answer
  2. B
    Grant the engineer the Project Viewer (`roles/viewer`) primitive role at the project level.
  3. C
    Revoke the Logs Viewer role at the project level and grant the Logs Viewer role at the organization level.
  4. D
    Grant the engineer the Logging Admin (`roles/logging.admin`) role at the project level.

Answer

Granting the Private Logs Viewer (`roles/logging.privateLogViewer`) role at the project level allows reading Data Access audit log entries while maintaining least privilege.
Data Access audit logs contain sensitive resource access information and are classified as private logs in Google Cloud Logging. The standard Logs Viewer role lacks the `logging.privateLogEntries.list` permission. Granting the Private Logs Viewer role fulfills the requirement using the least privilege principle.

Step-by-Step Solution

1
Identify the type of logs being queried
The engineer is attempting to view read operations on data, which are classified under Data Access Cloud Audit Logs.
Data Access audit logs are treated as private logs because they contain sensitive operation details and access metadata.
2
Analyze why the existing IAM role is insufficient
The standard Logs Viewer (`roles/logging.viewer`) role only permits reading public logs and Admin Activity logs, filtering out Data Access audit logs.
Google Cloud requires explicit private log viewing permissions (`logging.privateLogEntries.list`) to read Data Access audit logs.
3
Select the appropriate role adhering to least privilege
Assigning Private Logs Viewer (`roles/logging.privateLogViewer`) provides the necessary permission (`logging.privateLogEntries.list`) without granting administrative capabilities.
This specifically grants access to read private log entries without granting overprivileged resource management roles.

Key Concept

Cloud Audit Logs Access Control and Private Log Viewing
Estimated Time:2m 0s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic