Examkin

Question

Difficulty: MediumConfiguring Cloud Logging, Monitoring, and Operational Alerting

A retail enterprise is configuring a Cloud Logging sink to route operational logs from multiple Compute Engine projects into a centralized Cloud Storage bucket located in a dedicated security project. The log sink is configured using a sink-specific writer identity service account. According to Google Cloud security best practices and the principle of least privilege, which IAM role assignment should be applied to the destination bucket?

  1. Grant the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket to the log sink's writer service account identity.Answer
  2. B
    Grant the primitive Owner role (roles/owner) on the destination bucket to the log sink's writer service account identity.
  3. C
    Grant the Service Account User role (roles/iam.serviceAccountUser) on the target project to the log sink's writer service account identity.
  4. D
    Exclude all low-severity logs at the source project level by applying an exclusion filter that drops all logs below ERROR severity prior to sink processing.

Answer

Grant the Storage Object Creator role (roles/storage.objectCreator) on the destination bucket to the log sink's writer service account identity.
When configuring a Cloud Logging sink that routes log entries to Cloud Storage, Cloud Logging uses a unique service account (the sink's writer identity). To satisfy least-privilege requirements, this service account must only be granted permission to write objects to the target bucket, which is precisely provided by the predefined Storage Object Creator role (roles/storage.objectCreator).

Step-by-Step Solution

1
Identify the service account executing the write action.
Cloud Logging exports use a unique writer identity service account generated for the sink.
Log routing across projects requires explicit identity authentication at the export destination.
2
Determine the minimal IAM permissions needed by Cloud Logging for Cloud Storage destinations.
Cloud Logging only requires permissions to write new objects into the destination Cloud Storage bucket.
Objects written by log sinks do not need to be deleted or overwritten by the sink writer identity.
3
Select the predefined IAM role that matches these exact permissions.
The Storage Object Creator role (roles/storage.objectCreator) grants write-only access to create objects.
This fulfills least-privilege security requirements.

Key Concept

Least-privilege IAM configuration for Cloud Logging sink export destinations.
Rate this question

Topics

Configuring Cloud Logging, Monitoring, and Operational Alerting