Examkin

Question

Difficulty: MediumViewing and Analyzing Cloud Audit Logs

A lead infrastructure engineer is setting up audit log access for a developer team working within a Google Cloud project. The developers currently possess permissions to view standard Admin Activity audit logs, but they are unable to view Data Access audit logs required for troubleshooting data interactions. Following Google Cloud security best practices and the principle of least privilege, which IAM role should be assigned to the developers?

  1. Private Logs Viewer (roles/logging.privateLogViewer)Answer
  2. B
    Project Viewer (roles/viewer)
  3. C
    Logs Viewer (roles/logging.viewer) assigned at the Organization level
  4. D
    Organization Policy Admin (roles/orgpolicy.policyAdmin)

Answer

The Private Logs Viewer role (roles/logging.privateLogViewer) should be assigned to the developers.
Data Access audit logs contain sensitive API call data and user-provided data. Google Cloud restricts visibility of these logs so that standard log viewers (using roles/logging.viewer) cannot view them. To view Data Access audit logs while maintaining least privilege, users must be granted the Private Logs Viewer role (roles/logging.privateLogViewer).

Step-by-Step Solution

1
Identify the specific type of audit logs requested.
The requirement asks specifically for viewing Data Access audit logs.
Data Access audit logs contain sensitive resource access and API operation details, which are restricted compared to standard Admin Activity logs.
2
Evaluate IAM role capabilities for Cloud Logging under least privilege.
The standard Logs Viewer role (roles/logging.viewer) only permits reading non-private log entries and Admin Activity logs. Private Logs Viewer (roles/logging.privateLogViewer) is required for Data Access logs.
Granting Private Logs Viewer provides necessary read permissions for Data Access logs while adhering to least privilege without escalating permissions to administrative or primitive roles.

Key Concept

Cloud Audit Logs access control and least privilege role assignment for Data Access logs
Rate this question

Topics

Viewing and Analyzing Cloud Audit Logs

More questions from this topic