Question

A financial services company must migrate its audit logging system to Google Cloud. A regulatory requirement mandates that audit logs be retained for exactly 7 years and must be protected against deletion or modification by any user, including project administrators and security engineers, for the entire retention period. Access for reads must remain low-cost since logs are rarely queried after the first 30 days. Which storage design best meets these business and compliance requirements?

Accepted Answer

Store logs in a Cloud Storage bucket configured with a locked retention policy of 7 years and a lifecycle rule transitioning objects to Coldline or Archive after 30 days.

Answer

Store logs in a Cloud Storage bucket with a lifecycle rule that transitions objects to Archive class after 30 days and deletes them after 7 years, with IAM restricted to the security team.

Answer

Store logs in BigQuery with a table expiration of 7 years and rely on organization-level IAM policies to prevent modifications.

Answer

Store logs in a Cloud Storage bucket with object versioning enabled and grant only the security team the storage.objects.delete permission.