Examkin

Soru

Zorluk: OrtaViewing and Analyzing Cloud Audit Logs

A cloud security engineer needs to stream all Identity and Access Management (IAM) policy change audit logs from a Google Cloud project to a BigQuery dataset for long-term compliance analysis. In what sequential order should the engineer perform the steps to configure the Cloud Logging sink and grant the minimum necessary permissions for log streaming?

  1. 1Create a target BigQuery dataset within the project to receive the audit log entries.
  2. 2Create a Cloud Logging sink configured with an inclusion filter for IAM audit logs and set the target destination to the created BigQuery dataset.
  3. 3Retrieve the service account email (writer identity) created automatically during the log sink configuration.
  4. 4Grant the log sink's writer identity service account the BigQuery Data Editor role on the target BigQuery dataset.

Cevap

The correct sequence requires creating the destination BigQuery dataset first, configuring the Cloud Logging sink to point to the dataset, retrieving the sink's generated writer identity service account, and finally granting that service account the BigQuery Data Editor role on the dataset.
Log export in GCP follows a strict dependency workflow. First, the destination resource (the BigQuery dataset) must exist. Second, creating the log sink produces a dedicated service account known as the writer identity. Third, the administrator must retrieve this identity string. Fourth, the administrator grants that writer identity permission (such as BigQuery Data Editor) directly on the target dataset. This ensures proper log routing under the principle of least privilege.

Adım Adım Çözüm

1
Create the destination BigQuery dataset.
A target BigQuery dataset is created in the project to hold incoming log tables.
Log sinks require a pre-existing destination path upon creation.
2
Configure the Cloud Logging log sink targeting the BigQuery dataset.
The sink is established and Google Cloud automatically generates a unique service account (writer identity).
Creating the sink specifies what audit logs to filter and triggers identity generation.
3
Copy the generated writer identity service account identifier.
The exact service account email assigned to the sink is identified.
Permissions must be assigned to this specific identity to authorize log writing.
4
Grant the writer identity the BigQuery Data Editor role on the dataset.
Log entries begin streaming successfully from Cloud Logging into BigQuery.
Without dataset-level write permissions assigned to the sink's writer identity, log export attempts will fail due to access denied errors.

Anahtar Kavram

Cloud Logging Sinks and Service Account Writer Identity Authorization
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Viewing and Analyzing Cloud Audit Logs

Bu konudan daha fazla soru