Question

A financial services company must retain all admin activity audit logs for 7 years to satisfy a regulatory requirement. Auditors demand assurance that no one — including project owners or the security team — can delete or shorten the retention of these logs during the retention period. The logs are currently stored in the default _Required log bucket. What should the security engineer do?

Accepted Answer

Create a custom Cloud Logging log bucket with a 7-year retention period, enable a retention lock on the bucket, and route audit logs to it via a log sink.

Answer

Increase the retention period of the _Required log bucket to 7 years and grant the Logs Configuration Writer role only to the security team.

Answer

Export the audit logs to a Cloud Storage bucket with a lifecycle rule that deletes objects after 7 years, and apply uniform bucket-level access.

Answer

Create a BigQuery dataset with a table expiration of 7 years and use an aggregated sink to stream all audit logs into it for long-term retention.