A Security Operations analyst needs to enable tracking for sensitive bucket access and analyze the resulting Cloud Audit Logs for Google Cloud Storage within a specific GCP project. What is the correct sequence of steps to configure audit logging, assign necessary permissions, and retrieve the audit entries?
- 1Navigate to IAM & Admin > Audit Logs in the GCP Console and enable 'DATA_READ' and 'DATA_WRITE' log types for the Google Cloud Storage service.
- 2Grant the analyst the Private Logs Viewer role (roles/logging.privateLogViewer) to allow access to sensitive Data Access log payloads.
- 3Open Cloud Logging > Logs Explorer in the GCP Console and select the target project scope.
- 4Execute a filter query specifying protoPayload.serviceName="storage.googleapis.com" and logName="projects/PROJECT_ID/logs/cloudaudit.googleapis.com%2Fdata_access".
Cevap
The correct sequence starts with configuring IAM & Admin Audit Logs to enable Data Access logging for Cloud Storage, followed by assigning the Private Logs Viewer role to the analyst. Next, open the Logs Explorer interface in the GCP Console, and finally execute the specific query filtering for Cloud Storage Data Access audit logs.
To inspect Data Access audit logs, the logs must first be generated by enabling them under IAM & Admin > Audit Logs. Second, security analysts must hold the Private Logs Viewer role because standard log viewing roles exclude sensitive Data Access payloads. Third, analysts navigate to Logs Explorer, and finally, they submit a filter expression pointing to the Cloud Storage service and the cloudaudit.googleapis.com/data_access log stream.
Adım Adım Çözüm
Anahtar Kavram
Configuring, granting permissions for, and querying GCP Cloud Audit Logs (Data Access logs)