A cloud security engineer needs to stream all Identity and Access Management (IAM) policy change audit logs from a Google Cloud project to a BigQuery dataset for long-term compliance analysis. In what sequential order should the engineer perform the steps to configure the Cloud Logging sink and grant the minimum necessary permissions for log streaming?
- 1Create a target BigQuery dataset within the project to receive the audit log entries.
- 2Create a Cloud Logging sink configured with an inclusion filter for IAM audit logs and set the target destination to the created BigQuery dataset.
- 3Retrieve the service account email (writer identity) created automatically during the log sink configuration.
- 4Grant the log sink's writer identity service account the BigQuery Data Editor role on the target BigQuery dataset.
Answer
The correct sequence requires creating the destination BigQuery dataset first, configuring the Cloud Logging sink to point to the dataset, retrieving the sink's generated writer identity service account, and finally granting that service account the BigQuery Data Editor role on the dataset.
Log export in GCP follows a strict dependency workflow. First, the destination resource (the BigQuery dataset) must exist. Second, creating the log sink produces a dedicated service account known as the writer identity. Third, the administrator must retrieve this identity string. Fourth, the administrator grants that writer identity permission (such as BigQuery Data Editor) directly on the target dataset. This ensures proper log routing under the principle of least privilege.
Step-by-Step Solution
Key Concept
Cloud Logging Sinks and Service Account Writer Identity Authorization
Estimated Time:1m 30s