Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A compliance auditor needs to inspect all Cloud Audit Logs for a target Google Cloud project, including sensitive Data Access logs containing personally identifiable information (PII). Following the principle of least privilege, the auditor must be granted read access to these logs without being given access to inspect resource data or perform administrative changes. Which IAM role should be assigned to the auditor?

  1. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  2. B
    Logs Viewer (roles/logging.viewer)
  3. C
    Project Viewer (roles/viewer)
  4. D
    Organization Viewer (roles/viewer) at the organization level

Answer

Granting the Private Logs Viewer (roles/logging.privateLogViewer) role provides read access to all log entries, including restricted Data Access logs, without granting unnecessary permissions.
The Private Logs Viewer role (roles/logging.privateLogViewer) is explicitly designed to allow users to view all log entries in Cloud Logging, including restricted Data Access logs that contain sensitive or PII information, fulfilling security and compliance auditing needs under least privilege.

Step-by-Step Solution

1
Identify audit log access requirements
The requirement specifies reading Cloud Audit Logs, specifically including Data Access logs containing sensitive PII.
Data Access logs are restricted by default and cannot be accessed using standard logging viewer roles.
2
Evaluate Google Cloud IAM predefined roles for Cloud Logging
The Private Logs Viewer role (roles/logging.privateLogViewer) includes permissions for `logging.privateLogEntries.list` required to read Data Access logs.
Standard Logs Viewer (roles/logging.viewer) lacks permissions to view private log entries.
3
Apply the principle of least privilege
Assigning Private Logs Viewer grants exactly the necessary logging permissions without exposing project resources or configuration modification rights.
Primitive roles like Viewer or broader scopes at the organization level violate least privilege.

Key Concept

Cloud Audit Logs access control requires Private Logs Viewer (roles/logging.privateLogViewer) to view Data Access logs containing sensitive information.
Estimated Time:1m 15s
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic