An organization configures a Cloud Logging Log Router sink in an application project (`prod-app-project`) to route high-severity security logs to a Pub/Sub topic located in a centralized security project (`sec-audit-project`). After creating the sink, the engineer observes that log entries are not appearing in the Pub/Sub topic. Which configuration step must be performed to allow log entries to be successfully delivered to the destination?
- Copy the writer identity service account generated by the Log Router sink and grant it the Pub/Sub Publisher role on the Pub/Sub topic in `sec-audit-project`.Cevap
- BGrant the Editor primitive role on `sec-audit-project` to the user account that created the Log Router sink.
- CGrant the Logs Writer role to the Compute Engine default service account in `prod-app-project`.
- DEnable the Cloud Logging API in `sec-audit-project` to accept incoming log streams.
Cevap
The Log Router sink's unique writer identity service account must be granted the Pub/Sub Publisher role on the destination topic in the centralized security project.
When a Log Router sink is created in Google Cloud Logging, it generates a unique service account called a writer identity. For cross-project log routing to a Pub/Sub topic, this specific service account must explicitly be granted the Pub/Sub Publisher role on the target topic in the destination project.
Adım Adım Çözüm
Anahtar Kavram
Cloud Logging Log Router Sinks and Cross-Project Writer Identity Permissions