An organization is setting up a centralized compliance logging architecture in Google Cloud. An engineer configures a Cloud Logging Log Router sink in Project A to route all data access audit logs to a Cloud Storage bucket located in a dedicated security storage project, Project B. After creating the sink, logs fail to appear in the destination Cloud Storage bucket. The engineer confirms that the destination bucket path is correct, the sink filter is properly defined, and the bucket exists. Following the principle of least privilege, which action should the engineer take to resolve this issue and ensure logs are successfully written?
- Grant the Storage Object Creator role on the destination Cloud Storage bucket in Project B to the writer identity service account generated by the Log Router sink in Project A.Cevap
- BGrant the primitive Editor role on Project B to the Compute Engine default service account associated with Project A.
- CEnable the Cloud Logging API in Project B and grant the Logs Writer role to Project A at the Organization level.
- DRevoke the sink configuration in Project A and recreate the Log Router sink inside Project B using Project A's audit log bucket as the source.
Cevap
Grant the Storage Object Creator role on the destination Cloud Storage bucket in Project B to the writer identity service account generated by the Log Router sink in Project A.
When a Log Router sink is configured in Google Cloud Logging, a unique service account known as the sink's writer identity is created. When exporting logs across projects to a Cloud Storage bucket, the destination bucket must grant write permissions (specifically `roles/storage.objectCreator`) to this service account identity. This ensures compliance with the principle of least privilege while enabling successful log ingestion.
Adım Adım Çözüm
Anahtar Kavram
Cross-project Cloud Logging Log Router Sink Authorization