Examkin

Soru

Zorluk: Çok zorMonitoring and Logging

A Lead Site Reliability Engineer is designing a cross-project telemetry pipeline in Google Cloud. The architecture requires routing all IAM audit logs from a workload project (`proj-app-prod`) to a centralized security project (`proj-sec-analytics`) into a BigQuery dataset. Additionally, any unauthorized IAM policy modification attempt logged in `proj-app-prod` must trigger an immediate email notification via Cloud Monitoring. Which TWO of the following operational steps are required to implement this centralized logging and alerting architecture following Google Cloud best practices?

  1. Create a Cloud Logging export sink in `proj-app-prod` with an inclusion filter for audit logs targeting the BigQuery dataset in `proj-sec-analytics`, and grant the sink's unique writer identity service account the BigQuery Data Editor role on the destination dataset.Cevap
  2. Define a custom log-based counter metric in `proj-app-prod` that matches log entries for IAM policy changes, and create a Cloud Monitoring alerting policy condition based on this metric attached to a notification channel.Cevap
  3. C
    Grant the primitive Owner role on `proj-sec-analytics` to the default Compute Engine service account of `proj-app-prod` to bypass individual destination permissions for log routing.
  4. D
    Enable the legacy Stackdriver Logging API in `proj-sec-analytics` and install the legacy `stackdriver-log-collector` agent on all virtual machine instances to handle cross-project log delivery.

Cevap

Centralized audit log export requires creating a Cloud Logging sink in the source project targeting the destination BigQuery dataset in the central security project, followed by granting the sink's writer identity service account the BigQuery Data Editor role on the target dataset. For real-time alerting on specific log events, a custom log-based metric must be defined for matching log entries, and a Cloud Monitoring alerting policy must be configured using that metric.
To export logs across projects, Cloud Logging relies on Log Router sinks. When a sink is created with a destination in another project, GCP generates a unique writer identity service account for that sink. That specific service account must be granted the appropriate predefined role (such as BigQuery Data Editor) on the target resource. Furthermore, to alert on specific log event patterns like IAM modifications, a log-based metric must be created to convert matching log entries into time-series metric data, which can then be monitored by Cloud Monitoring alerting policies.

Adım Adım Çözüm

1
Configure cross-project log routing sink and service account permissions.
Create a sink in `proj-app-prod` targeting `bigquery.googleapis.com/projects/proj-sec-analytics/datasets/audit_logs` with a filter for audit logs. Retrieve the created sink's `writerIdentity` service account.
Log sinks require explicit destination permissions using their autogenerated writer identity service account.
2
Grant BigQuery write permissions to the sink's service account in the destination project.
Assign the `roles/bigquery.dataEditor` role to the sink's writer identity service account on the destination dataset in `proj-sec-analytics`.
Cross-project log exports fail unless the sink's service account has write permissions on the target resource.
3
Create a log-based counter metric for security events.
Define a counter metric in `proj-app-prod` filtering for log entries where `protoPayload.methodName` matches IAM policy update methods.
Log-based metrics bridge Cloud Logging event occurrences into quantitative time series metrics for monitoring.
4
Attach a Cloud Monitoring alerting policy to the log-based metric.
Create an alerting policy in Cloud Monitoring triggered when the log-based metric count exceeds zero within the alignment period, configured with an email notification channel.
Alerting policies evaluate metric time-series data to send notifications when threshold conditions are met.

Anahtar Kavram

Cross-Project Log Routing & Log-Based Metrics Alerting
Bu soruyu puanla

Konular

Monitoring and Logging

Bu konudan daha fazla soru