Question

Your security team wants to be alerted within minutes whenever anyone modifies an IAM policy at the organization level, so they can quickly investigate potential privilege escalation. Admin Activity audit logs are already being captured. The team wants a solution that requires no additional agents and uses native Cloud Operations capabilities to trigger notifications. What should you implement?

Accepted Answer

Create a log-based metric that matches SetIamPolicy audit log entries, then configure a Cloud Monitoring alerting policy on that metric with a notification channel.

Answer

Export all Admin Activity logs to BigQuery and schedule an hourly query that emails the team when new SetIamPolicy rows appear.

Answer

Enable Security Command Center Premium and rely on Security Health Analytics to detect the IAM policy modifications.

Answer

Install the Ops Agent on all VMs and configure it to forward IAM change events to Pub/Sub for processing.