Question

A financial services company must demonstrate to auditors that all reads and writes to a specific set of BigQuery datasets holding regulated customer data are logged, without incurring the cost and volume of enabling Data Access logs across every service in the organization. Their compliance mandate applies only to those datasets. What is the recommended approach to configure Data Access audit logs to satisfy this requirement efficiently?

Accepted Answer

Configure the IAM audit log settings to enable DATA_READ and DATA_WRITE for the BigQuery service scoped to the specific project containing the regulated datasets, and optionally use exempted members to reduce noise

Answer

Enable Data Access logs for the BigQuery service at the organization level and use log exclusion filters to drop everything except the regulated datasets

Answer

Rely on Admin Activity audit logs, which automatically capture all data read and write operations for regulated BigQuery datasets

Answer

Enable Access Transparency logs for the project, since they record all data access to customer data in the regulated datasets