Examkin

Question

Difficulty: MediumConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise operations team is configuring log routing from a production Google Cloud project to a centralized security project containing a BigQuery dataset for audit compliance. After creating the project-level Cloud Logging sink with a BigQuery dataset target, log entries are not appearing in the target dataset due to permission errors. You need to resolve the ingestion failure while adhering to Google Cloud security best practices and the principle of least privilege. Which action should you take?

  1. Grant the BigQuery Data Editor role on the target dataset to the service account writer identity generated by the Cloud Logging sink.Answer
  2. B
    Grant the primitive Owner role on the central security project to the service account writer identity generated by the Cloud Logging sink.
  3. C
    Grant the Service Account Admin role to the deployment identity so the log sink service account can impersonate the BigQuery admin service account.
  4. D
    Request a regional BigQuery API quota increase in the central security project before re-enabling the Cloud Logging sink routing rule.

Answer

Grant the BigQuery Data Editor role on the target dataset to the service account writer identity generated by the Cloud Logging sink.
When a Cloud Logging sink exports logs to a destination in another project (such as BigQuery), Cloud Logging creates a dedicated writer service account. Granting the BigQuery Data Editor role specifically on the destination dataset grants the sink the necessary permissions to write log tables while strictly honoring least-privilege security guidelines.

Step-by-Step Solution

1
Identify the writer identity associated with the Cloud Logging sink
Obtain the unique service account email generated by Cloud Logging for the sink (e.g., [email protected] or [email protected]).
Cloud Logging sinks use resource-based service accounts to authenticate log export destinations.
2
Determine the minimal IAM permissions needed on the BigQuery destination dataset
Identify that `roles/bigquery.dataEditor` provides dataset write access without exposing extra project-wide privileges.
Following least privilege ensures that the writer identity can only insert tables and stream data into the target dataset.
3
Apply the IAM role at the dataset level
Grant the writer identity the BigQuery Data Editor role directly on the target BigQuery dataset resource.
Dataset-scoped IAM access satisfies security requirements and allows the Cloud Logging sink to successfully route incoming log entries.

Key Concept

Cloud Logging Sink Writer Identity Permission Configuration
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting