A financial infrastructure company uses Google Cloud Pub/Sub and Cloud Run to process payment events across multiple Google Cloud projects. During a recent audit, compliance officers discovered that several high-severity payment failure log entries failed to route to the central long-term Cloud Storage sink. An investigation reveals that a developer implemented an aggregate log exclusion filter at the organization level to control ingestion costs, but it accidentally matched critical transaction audit entries. Additionally, an alerting policy monitoring transaction failures using a log-based metric has ceased notifying the incident handling pub/sub topic. How should the principal cloud architect resolve both the missing compliance logs and restore operational alerting while following Google Cloud security best practices?
- AModify the organization log exclusion filter using a narrowed boolean evaluation to explicitly match non-compliance log names while allowing payment audit entries, and verify that the custom log-based metric service account holds the Monitoring Notification Channel Editor role.
- BRemove the exclusion filter entirely across all projects, and grant the primitive Owner role to the Cloud Logging service account associated with the project sink.
- Refine the exclusion filter expression to exclude low-severity operational logs while protecting high-severity payment audit logs, and ensure the log-based metric alert condition evaluates non-zero count thresholds properly without relying on elevated administrative service account roles.Cevap
- DUpdate the exclusion filter to drop all logs matching severity standard INFO, and grant Service Account Admin privileges to the Cloud Monitoring alerting service account.