An enterprise organization needs to centralize operational and security audit logs across multiple Google Cloud projects into a designated security operations project. The solution must ensure secure, least-privilege log delivery to a central BigQuery dataset while excluding low-severity debug logs to control storage costs, without dropping high-severity operational events. Which TWO actions should you take to implement this architecture?
- Create an aggregated Log Router sink at the Google Cloud Organization level targeting the destination BigQuery dataset, using an inclusion filter for severity ERROR and audit logs.Answer
- Grant the unique writer identity service account generated by the Log Router sink the BigQuery Data Editor role on the target destination dataset.Answer
- CConfigure a global log exclusion filter set to drop all cloudaudit.googleapis.com records across the organization to minimize ingestion bandwidth.
- DAssign the Owner primitive IAM role to the Log Router service account across all projects to ensure unrestricted write access.
- ERely strictly on project IAM read permissions to prevent authorized analysts from copying dataset contents to external storage buckets.
Answer
Creating an aggregated Log Router sink at the organization level with an inclusion filter for required high-severity logs, and granting the sink's generated writer identity least-privilege write permissions (BigQuery Data Editor) on the central dataset.
Centralized observability across multiple projects is best achieved by establishing an aggregated Log Router sink at the Organization level with targeted log filters. The sink automatically receives a unique writer identity service account, which must be granted minimum required permissions (such as BigQuery Data Editor) on the destination dataset to adhere to security best practices.
Step-by-Step Solution
Key Concept
Centralized Log Router Sinks & Least-Privilege Log Export Architecture