Question

Your security team stores audit logs in a centralized Cloud Logging log bucket in a dedicated logging project. An external compliance auditor needs read access to only the Data Access audit logs originating from one specific production project, but the log bucket also contains logs from dozens of other projects. You must grant the auditor visibility to just the relevant logs without duplicating or exporting the data elsewhere. What is the most appropriate approach?

Accepted Answer

Create a log view on the log bucket that filters entries to the specific production project's Data Access logs, then grant the auditor the Logs View Accessor role scoped to that log view.

Answer

Grant the auditor the Logs Viewer (roles/logging.viewer) role at the logging project level so they can query the log bucket.

Answer

Create a new aggregated sink that exports only the production project's Data Access logs to a separate BigQuery dataset and grant the auditor BigQuery Data Viewer.

Answer

Grant the auditor the Private Logs Viewer (roles/logging.privateLogViewer) role on the logging project to allow read access to the Data Access logs.