Examkin

Soru

Zorluk: KolayMonitoring and Logging

A DevOps team needs to route application logs generated by workloads running in Google Cloud Project-A to a central BigQuery dataset hosted in Project-B for long-term security compliance and querying. Which TWO actions must be configured to successfully set up this log export?

  1. Create a Log Router sink in Project-A with a inclusion filter for application logs, specifying the BigQuery dataset in Project-B as the destination.Cevap
  2. B
    Grant the primitive Owner role to the organization service account on Project-A to inherit full permission across both projects.
  3. Grant the Log Router sink's writer service account the BigQuery Data Editor role on the destination dataset in Project-B.Cevap
  4. D
    Enable the Cloud Logging API exclusively in Project-B to allow Project-A to write directly to its storage resources.

Cevap

To export logs across projects to BigQuery, you must create a Log Router sink in the source project specifying the destination dataset path, and grant the generated sink writer service account appropriate access (such as BigQuery Data Editor) on the destination dataset.
Exporting logs to a BigQuery dataset in another project requires two main elements: defining the sink with an inclusion filter in the source project pointing to the target BigQuery destination, and assigning appropriate IAM permissions (such as BigQuery Data Editor) to the sink's uniquely generated writer service account in the target project dataset.

Adım Adım Çözüm

1
Configure the Log Router sink in the source project.
A sink filter identifies matching logs in Project-A and targets the dataset in Project-B (`bigquery.googleapis.com/projects/Project-B/datasets/dataset_name`).
Log export rules are defined at the source project level where log entries are emitted.
2
Identify the writer service account created by Cloud Logging for the sink.
A unique service account identity (formatted like `[email protected]`) is generated.
Cloud Logging uses service accounts to authenticate log delivery across project boundaries.
3
Grant dataset-level IAM permissions in the destination project.
The sink writer service account receives the BigQuery Data Editor role on the target dataset in Project-B.
Without explicit IAM write access on the destination dataset, log export will fail due to permission denied errors.

Anahtar Kavram

Log Router Sink Cross-Project Configuration and IAM Service Account Authorization
Bu soruyu puanla

Konular

Monitoring and Logging

Bu konudan daha fazla soru