Question

During an active investigation, your security team suspects that a compromised service account was used to modify and delete objects in a Cloud Storage bucket over the past several days. Legal requires that all relevant Cloud Logging entries be preserved in a tamper-resistant, immutable form for potential litigation, and the retention must survive any attempt by an attacker with project-level permissions to delete logs. Which approach best meets these requirements?

Accepted Answer

Create a dedicated log bucket in a separate, tightly controlled project, route the relevant logs there via an aggregated sink, and apply a locked retention policy on the log bucket.

Answer

Increase the _Default log bucket retention period to 3650 days and rely on IAM to prevent deletion of log entries.

Answer

Export the logs to a BigQuery dataset in the same project and grant the legal team the BigQuery Data Viewer role.

Answer

Enable Access Transparency logs and forward them to a Pub/Sub topic monitored by the incident response team.