A enterprise healthcare organization requires immutable, real-time security auditing for all Cloud Key Management Service (KMS) operations across its Google Cloud resource hierarchy. Project administrators must not be able to disable audit logging or modify the export destination. Additionally, all cryptographic key access events must be centralized for security analysis. Which TWO actions should the cloud security architect take to meet these governance requirements?
- Configure an organization-level aggregated log sink with includeChildren set to true that routes audit logs to a central Pub/Sub topic in a dedicated security project.Answer
- Enable Data Access audit logs for Cloud KMS at the organization level audit config to capture cryptographic key read and write operations across all projects.Answer
- CGrant the primitive Owner role to individual service accounts handling log sinks to ensure they have administrative permissions to bypass exclusion filters.
- DRequire each project administrator to manage log destinations locally using Customer-Supplied Encryption Keys (CSEK) for Cloud Storage audit buckets.
Answer
The architect must configure an organization-level aggregated log sink with child inclusion enabled, and explicitly turn on Cloud KMS Data Access audit logs at the organization level.
To achieve tamper-proof, real-time central auditing across all projects, an organization-level aggregated log sink with child project inclusion ensures that all log entries are captured automatically regardless of project admin actions. Concurrently, Cloud KMS key usage events require enabling Data Access audit logs explicitly at the organization level because Admin Activity logs only record resource creation and metadata changes.
Step-by-Step Solution
Key Concept
Centralized Organization Audit Logging and Cloud KMS Audit Configuration