Examkin

Question

Difficulty: MediumMonitoring and Logging

An operations team creates a Cloud Logging Log Router sink in a source Google Cloud project to export audit logs to a Pub/Sub topic located in a separate compliance project. After configuring the sink, they observe that log messages are not arriving in the destination Pub/Sub topic. What configuration step is required to enable log delivery?

  1. Grant the Pub/Sub Publisher role to the unique writer identity service account generated by the Log Router sink on the destination Pub/Sub topic.Answer
  2. B
    Grant the primitive Owner role on the compliance project to the source project's default Compute Engine service account.
  3. C
    Enable the Cloud Logging API in the compliance destination project to allow incoming log streams.
  4. D
    Install the legacy Stackdriver Logging agent on the Pub/Sub service instances to accept cross-project telemetry.

Answer

Grant the Pub/Sub Publisher role to the unique writer identity service account generated by the Log Router sink on the destination Pub/Sub topic.
When creating a Cloud Logging Log Router sink to export logs across projects (such as to a Pub/Sub topic, Cloud Storage bucket, or BigQuery dataset), Google Cloud assigns a unique service account known as the sink's writer identity. To allow successful log delivery, this writer identity service account must be granted appropriate predefined IAM permissions—specifically the Pub/Sub Publisher role—directly on the destination Pub/Sub topic.

Step-by-Step Solution

1
Identify the authentication mechanism used by Cloud Logging Log Router sinks.
Recognize that creating a sink automatically provisions a unique service account called a writer identity.
Log Router relies on identity-based IAM authorization to write entries into export destinations.
2
Determine the required IAM role for writing to a Pub/Sub topic across project boundaries.
Identify that the Pub/Sub Publisher role (roles/pubsub.publisher) is required on the destination Pub/Sub topic.
Without this predefined role granted to the sink's specific writer identity, Google Cloud denies delivery attempts.
3
Apply least-privilege security principles to complete the integration.
Assign the Pub/Sub Publisher role specifically to the sink's writer identity service account on the destination topic.
This establishes explicit, minimal permission for cross-project log ingestion.

Key Concept

Log Router Sink Writer Identity and Cross-Project IAM Authorization
Rate this question

Topics

Monitoring and Logging

More questions from this topic