An enterprise organization wants to collect and centralize application log entries from all Google Cloud projects within its organization hierarchy into a single BigQuery dataset hosted in a dedicated security project. The architecture must adhere to Google Cloud recommended best practices for security and minimal operational overhead. Which approach should the Cloud Architect implement to configure this logging pipeline?
- Create an aggregated log sink at the Organization level configured with BigQuery as the destination, and grant the sink's dedicated writer identity the BigQuery Data Editor role on the central dataset.Answer
- BCreate an aggregated log sink at the Organization level configured with BigQuery as the destination, and grant the sink's service account the primitive Owner role on the target project.
- CCreate individual log sinks in each project and assign the Service Account Admin role to the administrator's account on each sink's writer service account.
- DCreate an aggregated log sink at the Organization level with an exclusion filter configured as severity >= ERROR to control BigQuery storage costs.
Answer
Create an aggregated log sink at the Organization level with BigQuery as the destination, and grant the sink's writer identity the BigQuery Data Editor role on the central dataset.
An aggregated log sink created at the Organization level automatically gathers logs across all descendant resources. Granting the sink's writer identity a specific, predefined role (BigQuery Data Editor) directly on the target dataset satisfies least-privilege security principles.
Step-by-Step Solution
Key Concept
Organization-level aggregated log sinks and least-privilege destination authorization