Examkin

Question

Difficulty: Very hardConfiguring Cloud Logging, Monitoring, and Operational Alerting

An enterprise financial platform operates across multiple Google Cloud folders within an Organization hierarchy. The Site Reliability Engineering (SRE) team is designing a centralized operational logging architecture to route high-severity operational error logs (`severity>=ERROR`) from all current and future projects into a centralized BigQuery dataset located in a dedicated telemetry project `fin-logs-prod`. The solution must ensure that project-level administrators cannot modify or disable the log routing configuration, and the principle of least privilege must be strictly enforced for dataset access. Which TWO configuration steps should you perform to accomplish this architecture?

  1. Create an aggregated log sink at the Organization level configured with the `--include-children` flag and set the destination to the central BigQuery dataset.Answer
  2. Grant the `roles/bigquery.dataEditor` IAM role on the destination BigQuery dataset to the service account writer identity generated by the aggregated log sink.Answer
  3. C
    Grant the primitive `roles/owner` IAM role to the log sink writer identity across the `fin-logs-prod` telemetry project.
  4. D
    Assign the `roles/iam.serviceAccountAdmin` IAM role to workload project service accounts so they can manage the writer identity credentials.
  5. E
    Configure a project-level log exclusion filter containing `severity>=ERROR` in each workload project to prevent duplicate ingestion into project-level buckets.

Answer

Create an aggregated log sink at the Organization level configured with the `--include-children` flag targeting BigQuery, and grant the `roles/bigquery.dataEditor` role on the target BigQuery dataset to the log sink writer identity service account.
To centralize log routing securely across an enterprise hierarchy without allowing project administrators to override policies, an aggregated sink must be created at the Organization level using the `--include-children` flag. Additionally, to adhere to the principle of least privilege, the sink's unique writer identity service account should only be granted `roles/bigquery.dataEditor` directly on the target BigQuery dataset.

Step-by-Step Solution

1
Define organizational scope and central sink deployment
Aggregated sink captures logs from all current and future projects beneath the Organization level
Creating the sink at the Organization level with `--include-children` prevents project admins from modifying the sink settings while enforcing enterprise-wide log aggregation.
2
Retrieve the unique writer identity created by the aggregated sink
Identified service account formatted as `serviceAccount:[email protected]`
Cloud Logging exports require permission delegation through a system-generated writer service account identity.
3
Apply least-privilege IAM roles on the target BigQuery dataset resource
Writer identity can insert data into the specific BigQuery dataset without project-level administrative rights
Granting `roles/bigquery.dataEditor` on the dataset ensures least privilege access needed for log ingestion.

Key Concept

Organizational Aggregated Log Sinks and Least-Privilege IAM Routing
Estimated Time:3m 0s
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting