An organization needs to configure a centralized pipeline to stream Google Cloud Audit Logs across all existing and future projects to an external Security Information and Event Management (SIEM) platform in real time. Arrange the required implementation steps in the correct architectural sequence to achieve this workflow.
- 1Create a Pub/Sub topic in a centralized telemetry project to serve as the ingestion buffer for log entries.
- 2Create an organization-level aggregated log sink with an inclusion filter for Cloud Audit Logs directed to the Pub/Sub topic.
- 3Grant the service account identity generated by the aggregated log sink the Pub/Sub Publisher IAM role on the central topic.
- 4Configure a Pub/Sub pull subscription or Dataflow pipeline to forward received log events into the SIEM endpoint.
Cevap
The correct operational sequence begins by provisioning the central Pub/Sub topic, creating the organization-level aggregated log sink targeting that topic, granting the sink's generated service account permission to publish to the topic, and finally configuring the streaming pipeline consumer to deliver log events to the external SIEM.
Establishing a centralized, real-time audit log streaming architecture requires creating the target Pub/Sub topic first so it exists as a valid sink destination. Creating the organization-level aggregated log sink next creates the log router configuration and automatically generates a unique writer identity service account. Assigning the Pub/Sub Publisher role to this generated service account authorizes cross-project log ingestion. Finally, deploying the downstream consumer on the Pub/Sub subscription initiates telemetry delivery to the SIEM.
Adım Adım Çözüm
Anahtar Kavram
Organization-Aggregated Cloud Audit Log Routing with Pub/Sub