A Cloud Engineer needs to export Data Access audit logs from a Google Cloud project to a Cloud Storage bucket for long-term compliance storage. Which of the following configuration steps must be performed to successfully setup this log export? (Select TWO.)
- Create a Log Router sink in Cloud Logging with a filter for Data Access audit logs, specifying the Cloud Storage bucket as the destination.Cevap
- Grant the Storage Object Creator role to the writer identity service account generated by the Log Router sink on the destination Cloud Storage bucket.Cevap
- CGrant the Project Owner primitive role to the Log Router sink service account on the destination project to enable log writing.
- DEnable the Cloud Logging API in the organization resource node rather than in the project containing the log sink.
Cevap
To set up log export to Cloud Storage, you must create a Log Router sink filtering for Data Access audit logs with the bucket destination, and grant the sink's writer identity service account the Storage Object Creator role on that bucket.
Exporting logs via Cloud Logging Log Router requires creating a sink configured with an appropriate log filter and destination, as well as granting the sink's generated writer identity service account the least-privilege role (Storage Object Creator) on the destination bucket.
Adım Adım Çözüm
Anahtar Kavram
Configuring Cloud Logging Log Router sinks and destination IAM permissions