Question

A financial services company must satisfy an external auditor's requirement that the security team responsible for reviewing activity logs cannot alter, delete, or disable the logs they inspect. The security analysts currently hold the project Editor role, which the auditor has flagged as a violation of separation-of-duties controls. As the cloud architect, what is the most appropriate IAM change to make?

Accepted Answer

Remove the Editor role and grant the analysts only the Private Logs Viewer (roles/logging.privateLogViewer) role, while restricting log configuration and sink management to a separate platform team.

Answer

Grant the security analysts the Logging Admin (roles/logging.admin) role so they have full control over log configuration and viewing.

Answer

Keep the Editor role but add an organization policy that prevents anyone from deleting log entries.

Answer

Grant the security analysts the Project Viewer (roles/viewer) role at the project level so they can read logs without any write access.