Your enterprise organization centralizes logs from multiple application projects into a dedicated centralized logging project. Your compliance and operations teams have established the following access control requirements for multi-project observability: Application Developers must be able to view and search application logs for troubleshooting, but they must be restricted from viewing sensitive personally identifiable information (PII), such as user email addresses embedded in LogEntry payloads. Security Analysts must have full visibility into all log data, including both the payload fields and restricted audit details across all projects. The access control model must maintain strict separation of duties without requiring the duplication of logs into multiple regional storage buckets. Which solution should you implement to meet these requirements?

Configure field-level access controls on the centralized log bucket to restrict the sensitive PII payload fields, grant developers the Logs Viewer role without field access permissions, and grant security analysts the Logs Viewer role along with the Field Accessor role.: ### What Field-Level Access Control Is **Field-level access control** in Cloud Logging provides granular security by allowing administrators to restrict access to specific fields inside a `LogEntry` (such as `jsonPayload.email` or `jsonPayload.ssn`) while keeping the rest of the log record visible. Users without specific permissions can view the log entry, but restricted fields are masked or hidden. ### How It Meets the Requirements - **Developer PII Restriction**: Configuring field-level access controls on the centralized log bucket and granting developers standard viewing roles (such as `roles/logging.viewer`) ensures they can query, filter, and view application logs for debugging while automatically hiding sensitive PII fields. - **Security Analyst Full Access**: Granting security analysts the `roles/logging.fieldAccessor` role in addition to `roles/logging.viewer` gives them full clearance to read both unrestricted and restricted fields across the entire centralized repository. - **No Log Duplication**: Access is evaluated in-place at query time on the existing log bucket, satisfying compliance and separation of duties without routing duplicate log copies to separate destinations. ### Key Advantages and Capabilities - **Granular Payload Redaction**: Protects sensitive strings, user tokens, and PII without dropping or splitting whole log entries. - **Separation of Duties**: Cleanly separates standard operational debugging from privileged security investigations via distinct IAM roles. - **Single Source of Truth**: Eliminates synchronization overhead, storage inflation, and compliance drift caused by maintaining parallel log streams. - **Centralized Enforcement**: Applied directly at the storage bucket level, ensuring consistent policy across all aggregated project logs. ### Why This Is Optimal Field-level access control operates natively within the Cloud Logging platform. Compared to managing multiple log sinks or restricting access purely by entire log views, field-level controls enforce least privilege at the field level without complicating data routing topologies.

Centralized Logging Iam Field Level Access Control | Professional Cloud DevOps Engineer

Centralized Logging Iam Field Level Access Control

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization centralizes logs from multiple application projects into a dedicated centralized logging project. Your compliance and operations teams have established the following access control requirements for multi-project observability:

Application Developers must be able to view and search application logs for troubleshooting, but they must be restricted from viewing sensitive personally identifiable information (PII), such as user email addresses embedded in LogEntry payloads.
Security Analysts must have full visibility into all log data, including both the payload fields and restricted audit details across all projects.
The access control model must maintain strict separation of duties without requiring the duplication of logs into multiple regional storage buckets.

Which solution should you implement to meet these requirements?

Grant developers the Private Logs Viewer role in the development projects, and grant security analysts the Logs Admin role on the centralized logging project.

Create two separate log views on the centralized log bucket: one with an inclusion filter that omits PII and another with no filter. Assign developers access to the filtered log view and assign security analysts access to the unfiltered log view.

Configure a central log sink with exclusion filters that drops all payload fields containing email addresses before ingesting them into the log bucket, and assign the Logs Viewer role to all teams.

Configure field-level access controls on the centralized log bucket to restrict the sensitive PII payload fields, grant developers the Logs Viewer role without field access permissions, and grant security analysts the Logs Viewer role along with the Field Accessor role.

Professional Cloud DevOps Engineer

Centralized Logging Iam Field Level Access Control

Related questions