An enterprise architecture team is configuring a centralized log sink in Google Cloud to route operational application logs from a workload project to a Cloud Storage bucket for compliance archiving. The team needs to prevent verbose debug logs from being exported to minimize storage costs, while ensuring the log sink's writer identity adheres strictly to the principle of least privilege on the destination storage bucket. Which approach correctly achieves this configuration?
- Define a log sink with a filter matching application logs with severity INFO or higher, and grant the sink's writer identity service account the Storage Object Creator role on the target Cloud Storage bucket.Answer
- BDefine a log sink without filters and grant the sink's writer identity service account the Editor primitive role on the project containing the target Cloud Storage bucket.
- CDefine a log sink with an exclusion filter set to severity >= INFO, and grant the sink's writer identity service account the Storage Object Admin role on the target bucket.
- DDefine a log sink with a filter selecting all logs, and grant the operations team's service account the Service Account Admin role to dynamically manage bucket permissions.
Answer
Configure a log sink filter that includes logs with severity INFO or higher to exclude debug entries, and assign the Storage Object Creator role (`roles/storage.objectCreator`) directly to the log sink's unique writer identity service account on the destination Cloud Storage bucket.
The correct approach configures an inclusion filter (`severity >= INFO`) on the log sink so that low-priority DEBUG logs are filtered out prior to export, reducing storage costs. It then grants the minimal required IAM role (`roles/storage.objectCreator`) specifically to the log sink's unique writer identity service account on the destination bucket, satisfying least-privilege security mandates.
Step-by-Step Solution
Key Concept
Log sink filtering and least-privilege IAM configuration for Cloud Logging export destinations.