A security architect is configuring an enterprise-wide audit logging solution in Google Cloud Platform to stream Cloud Audit Logs from an entire organization to an external SIEM system via Pub/Sub. In what sequence should these steps be executed to establish the log export pipeline successfully?
- 1Create a target Pub/Sub topic in a centralized security administration project.
- 2Create an organization-level Cloud Logging sink specifying the Pub/Sub topic as the destination.
- 3Grant the Pub/Sub Publisher IAM role to the logging sink's unique writer service account on the Pub/Sub topic.
- 4Configure the external SIEM platform to consume audit messages from the Pub/Sub subscription.
Cevap
The correct sequence is: first, create the target Pub/Sub topic in the central project; second, create the organization-level Cloud Logging sink pointing to the topic; third, grant the sink's unique writer service account the Pub/Sub Publisher role on the topic; and fourth, configure the SIEM to consume messages from the Pub/Sub subscription.
Establishing a Cloud Logging export pipeline requires creating the destination Pub/Sub topic first. Next, creating the organization-level log sink defines the filter rules and automatically creates a unique service account identity (writer identity). Third, this specific service account must be granted the Pub/Sub Publisher role on the topic to authorize writing. Finally, the downstream SIEM consumer connects to the subscription to pull the audit logs.
Adım Adım Çözüm
Anahtar Kavram
Cloud Audit Logs Aggregated Export & Service Account Authorization Workflow