Soru

Zorluk: Çok zorMonitoring and Logging

An organization is setting up a centralized compliance logging architecture in Google Cloud. An engineer configures a Cloud Logging Log Router sink in Project A to route all data access audit logs to a Cloud Storage bucket located in a dedicated security storage project, Project B. After creating the sink, logs fail to appear in the destination Cloud Storage bucket. The engineer confirms that the destination bucket path is correct, the sink filter is properly defined, and the bucket exists. Following the principle of least privilege, which action should the engineer take to resolve this issue and ensure logs are successfully written?

  1. Grant the Storage Object Creator role on the destination Cloud Storage bucket in Project B to the writer identity service account generated by the Log Router sink in Project A.Cevap
  2. B
    Grant the primitive Editor role on Project B to the Compute Engine default service account associated with Project A.
  3. C
    Enable the Cloud Logging API in Project B and grant the Logs Writer role to Project A at the Organization level.
  4. D
    Revoke the sink configuration in Project A and recreate the Log Router sink inside Project B using Project A's audit log bucket as the source.

Cevap

Grant the Storage Object Creator role on the destination Cloud Storage bucket in Project B to the writer identity service account generated by the Log Router sink in Project A.
When a Log Router sink is configured in Google Cloud Logging, a unique service account known as the sink's writer identity is created. When exporting logs across projects to a Cloud Storage bucket, the destination bucket must grant write permissions (specifically `roles/storage.objectCreator`) to this service account identity. This ensures compliance with the principle of least privilege while enabling successful log ingestion.

Adım Adım Çözüm

1
Identify the service account identity used by Cloud Logging Log Router.
When a sink is created in Cloud Logging, GCP assigns a unique writer identity service account (formatted as serviceAccount:[email protected]).
Log Router exports run under this dedicated service account identity rather than instance or default project service accounts.
2
Determine the destination permissions required for cross-project Cloud Storage log exports.
The destination storage bucket requires permissions for the sink's writer identity to write log files into the bucket.
Cross-project log export requires explicit authorization on the destination resource.
3
Apply the principle of least privilege.
Granting `roles/storage.objectCreator` on the specific destination bucket allows object creation without granting excess permissions across Project B.
This satisfies security requirements and enables proper log ingestion.

Anahtar Kavram

Cross-project Cloud Logging Log Router Sink Authorization
Bu soruyu puanla