A financial technology company hosts a legacy transaction processing application on Compute Engine Virtual Machines (VMs). The operations team must collect detailed system memory metrics and custom application logs, ensuring that telemetry data is securely ingested into Cloud Monitoring and Cloud Logging following Google Cloud security best practices. Which architectural approach should the Cloud Architect recommend?
- Install the Google Cloud Ops Agent on the Compute Engine instances and attach a dedicated service account configured with minimal predefined roles for log ingestion and metric writing.Answer
- BInstall the Google Cloud Ops Agent on the Compute Engine instances and assign the Editor primitive IAM role to the default Compute Engine service account to simplify telemetry authorization.
- CInstall the Google Cloud Ops Agent on the Compute Engine instances and configure an aggregate Cloud Logging exclusion filter that drops all logs with severity level ERROR and above to reduce telemetry volume.
- DConfigure identity permissions for metric write access and rely solely on IAM permissions without establishing VPC Service Controls perimeters to prevent unauthorized exfiltration of operational telemetry.
Answer
Install the Google Cloud Ops Agent on the Compute Engine instances and attach a dedicated service account configured with minimal predefined roles for log ingestion and metric writing.
Installing the Google Cloud Ops Agent provides unified logging and metrics collection (including memory utilization) on Compute Engine VMs. Attaching a dedicated service account with fine-grained predefined roles ensures compliance with security best practices and the principle of least privilege.
Step-by-Step Solution
Key Concept
Monitoring, Logging, and Observability Integration