Examkin

Question

Difficulty: EasyConfiguring Cloud Logging, Monitoring, and Operational Alerting

A Cloud Architect is deploying an application on Compute Engine instances that requires writing custom application logs to Cloud Logging and pushing custom operational metrics to Cloud Monitoring. Following the principle of least privilege, which TWO IAM roles should be assigned to the service account used by the Compute Engine instances?

  1. Logs Writer (roles/logging.logWriter)Answer
  2. Monitoring Metric Writer (roles/monitoring.metricWriter)Answer
  3. C
    Owner (roles/owner)
  4. D
    Service Account User (roles/iam.serviceAccountUser)
  5. E
    Monitoring Admin (roles/monitoring.admin)

Answer

The correct roles are Logs Writer (roles/logging.logWriter) and Monitoring Metric Writer (roles/monitoring.metricWriter).
To allow a Compute Engine service account to write custom logs and operational metrics under the principle of least privilege, grant Logs Writer (roles/logging.logWriter) for Cloud Logging ingestion and Monitoring Metric Writer (roles/monitoring.metricWriter) for Cloud Monitoring ingestion.

Step-by-Step Solution

1
Determine the minimal permissions required for logging and metric ingestion.
The application service account requires access to write logs into Cloud Logging and push custom metrics to Cloud Monitoring.
Enterprise security governance requires minimal fine-grained IAM roles for compute service accounts.
2
Identify the fine-grained predefined IAM roles for these actions.
Logs Writer (roles/logging.logWriter) provides write-only log capabilities, and Monitoring Metric Writer (roles/monitoring.metricWriter) allows writing metric data.
Predefined roles satisfy functional requirements while strictly adhering to least privilege.

Key Concept

Configuring Cloud Logging and Monitoring permissions using least-privilege predefined IAM roles
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting