Examkin

Question

Difficulty: MediumSecurity Logging, Audit Logs, and Security Command Center

An enterprise security architect needs to configure an organization-wide aggregated Cloud Audit Log pipeline to stream Data Access audit logs from all current and future child projects into a centralized BigQuery dataset in a security management project. Arrange the deployment steps in the correct chronological order required to successfully establish this aggregated sink with least privilege access.

  1. 1Create the destination BigQuery dataset within the dedicated security management project.
  2. 2Create the organization-level log sink specifying the BigQuery dataset destination filter and enabling the inclusion of child resources.
  3. 3Retrieve the auto-generated writer identity service account associated with the organization-level log sink.
  4. 4Grant the BigQuery Data Editor role to the log sink's writer identity service account on the destination BigQuery dataset.

Answer

The correct sequence begins by creating the destination BigQuery dataset, followed by creating the organization-level aggregated log sink with child inclusion enabled. Next, the auto-generated writer identity service account for the sink is retrieved, and finally, the service account is granted the BigQuery Data Editor role on the target dataset.
Establishing an organization-wide aggregated log sink requires creating the target dataset first, defining the organization sink with child inclusion to generate a dedicated service account identity, extracting that service account identity, and applying dataset-level IAM permissions to grant write access.

Step-by-Step Solution

1
Provision the destination storage resource in the security project.
A BigQuery dataset is created to serve as the destination URI for incoming audit log entries.
Cloud Logging sinks require an existing destination resource upon creation.
2
Execute the organization sink creation command defining the log filter and enabling child project aggregation.
The aggregated log sink is established at the organization root, and Cloud Logging creates a unique service account writerIdentity.
Creating an organization sink with the include-children parameter ensures log collection across the entire resource hierarchy.
3
Inspect the created sink properties to extract the writerIdentity service account string.
The sink's service account email address is obtained.
The service account identity is needed to grant target dataset access.
4
Apply IAM binding granting the writer identity service account BigQuery Data Editor permissions on the target dataset.
Logs begin successfully streaming from child projects into the centralized BigQuery dataset.
Least-privilege authorization must be explicitly configured on the destination resource for log writing to succeed.

Key Concept

Organization-Aggregated Cloud Audit Log Sinks and Service Account Authorization
Estimated Time:1m 30s
Rate this question

Topics

Security Logging, Audit Logs, and Security Command Center

More questions from this topic