Question

Your platform team is bootstrapping a new Google Cloud organization. Compliance requires that all audit logs from every current and future project be exported centrally to a BigQuery dataset in a dedicated security project, with the guarantee that individual project owners cannot delete or bypass this export. What is the most effective way to configure this during organization bootstrap?

Accepted Answer

Create an aggregated log sink at the organization level with the includeChildren option enabled, routing logs to the BigQuery dataset in the security project, and grant the sink's writer identity permission on that dataset.

Answer

Instruct each project team to create a project-level log sink pointing to the shared BigQuery dataset, and enforce this with a documented onboarding checklist.

Answer

Enable a folder-level log sink on the top folder only, since projects created outside that folder will inherit the export automatically through IAM.

Answer

Configure a Pub/Sub topic in each project and use a Cloud Function to forward logs to BigQuery, granting project owners edit access to manage the pipeline.