A company requires long-term retention of system error logs from Google Kubernetes Engine (GKE) clusters in a centralized Cloud Storage bucket located in a separate compliance project. An administrator configures an organization-level log sink with an inclusion filter for error log entries. However, logs are not appearing in the target destination bucket. Which action should be taken to ensure log delivery following the principle of least privilege?
- Grant the unique service account (writer identity) generated for the log sink the Storage Object Creator role on the destination Cloud Storage bucket.Answer
- BGrant the Cloud Logging Service Agent the primitive Owner role on the destination compliance project.
- CGrant the GKE node pool default service account the Service Account Admin role across the organization.
- DSubmit a Cloud Console support ticket to request a regional quota increase for aggregated log sink throughput.
Answer
Grant the unique service account (writer identity) generated for the log sink the Storage Object Creator role on the destination Cloud Storage bucket.
When configuring a Cloud Logging sink that exports logs to a destination in another project or resource, Cloud Logging generates a unique service account called a writer identity (e.g., `serviceAccount:[email protected]`). To grant log delivery access according to least privilege, you must grant this specific writer identity the `roles/storage.objectCreator` role directly on the destination Cloud Storage bucket.
Step-by-Step Solution
Key Concept
Log Sink Writer Identity IAM Permissions