Examkin

Question

Difficulty: MediumMonitoring and Logging

A Cloud Engineer is tasked with long-term retention of audit logs across all projects in an organization. The engineer creates an Organization-level Log Router sink configured to export Cloud Audit Logs to a centralized Cloud Storage bucket in a dedicated security project. Shortly after setup, the engineer notices that no log entries are arriving in the destination bucket. What is the most likely cause of this issue and how should it be resolved?

  1. The writer identity service account associated with the log sink has not been granted the necessary IAM role on the destination Cloud Storage bucket.Answer
  2. B
    The Cloud Engineer must assign the primitive Owner role to their personal user account on the target security project to authorize log transfer.
  3. C
    The Cloud Logging API must be manually enabled within the target Cloud Storage bucket configuration settings before log ingestion begins.
  4. D
    The legacy Stackdriver Logging agent must be installed on the Cloud Storage destination endpoint to ingest exported logs.

Answer

The writer identity service account generated by the Log Router sink must be granted permission (such as the Storage Object Creator role) on the destination Cloud Storage bucket.
When creating a Log Router sink that exports logs to a destination (such as Cloud Storage, Pub/Sub, or BigQuery), Cloud Logging generates a writer identity service account. To complete the configuration, appropriate IAM write permissions (e.g., Storage Object Creator) must be explicitly granted to that service account on the destination resource.

Step-by-Step Solution

1
Identify how Log Router sinks authorize writes to export destinations.
Creating a Log Router sink generates a unique writer identity service account.
Cloud Logging uses service accounts to publish logs safely to sinks across projects or organizations.
2
Verify IAM permissions on the destination resource.
The writer identity must be granted write access on the destination Cloud Storage bucket.
Without explicit IAM permissions granted to the sink's writer identity, log routing fails silently or logs access denied errors.

Key Concept

Cloud Logging Log Router cross-project destination authorization using writer identities
Rate this question

Topics

Monitoring and Logging

More questions from this topic