Your enterprise organization needs to centralize logging across all current and future projects into a dedicated project named logging-prod. The design must meet the following requirements: Automatically capture logs across all folders and child projects under the organization resource. Aggregate all Data Access audit logs into a custom, centralized Log Bucket located in logging-prod. Prevent Data Access audit logs from being duplicated in the originating projects' _Default log buckets to control storage costs, while ensuring mandatory system audit logs remain stored in each originating project's _Required bucket. Ensure the log routing mechanism adheres to supported destination constraints and uses the least privilege necessary. Which logging architecture should you implement?

Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags set to route logs to the logging-prod project, configure a log sink in logging-prod to route incoming entries into the custom Log Bucket, and grant the aggregated sink's writerIdentity the Logs Writer role on logging-prod.: ### What an Intercepting Aggregated Sink Is An **intercepting aggregated log sink** is an organization-level or folder-level routing rule configured in Cloud Logging that captures log entries from the parent resource and all child resources. Unlike non-intercepting sinks, an intercepting sink halts the downstream evaluation of matching log entries in child resources, preventing them from being processed by child-level sinks (such as the system-created `_Default` sink) while still guaranteeing delivery to the originating project's `_Required` sink. ### How It Meets the Requirements - **Captures all current and future projects**: Configuring the aggregated sink at the organization root with `--include-children` automatically encompasses all existing and newly created folders and projects without manual intervention. - **Prevents duplicate storage and controls costs**: By using `--intercept-children` (or setting `interceptChildren: true`), matching Data Access logs are intercepted and withheld from project-level `_Default` sinks, avoiding duplicate ingestion charges across hundreds of projects. - **Preserves mandatory audit logs**: Intercepting sinks never block delivery to the `_Required` log sink in the originating resource, ensuring Admin Activity and System Event logs remain compliant at the project boundary. - **Adheres to destination constraints and IAM**: Cloud Logging requires that the destination of an intercepting aggregated sink must be a **Google Cloud project**. Sinks within the destination project (`logging-prod`) then reroute the entries into storage repositories like custom Log Buckets. Granting **Logs Writer** (`roles/logging.logWriter`) to the sink's generated `writerIdentity` service account satisfies least-privilege destination access. ### Key Advantages and Capabilities - **Centralized Ingestion Control**: Eliminates the operational overhead of modifying individual project configurations across the organization. - **Architectural Scalability**: Future-proofs log collection as new projects and folders are provisioned dynamically. - **Cost Efficiency**: Eliminates redundant log ingestion and storage charges caused by dual routing in originating and central projects. - **Granular Rerouting**: Allows the destination project to further route, filter, or create log views across various organizational domains. ### Why This Is Optimal This architecture is the only design that strictly complies with Google Cloud's routing model: intercepting aggregated sinks must terminate at a project destination, where local sinks manage secondary delivery to custom Log Buckets while protecting child projects from double-storage costs.

Gcp Centralized Log Aggregation Intercepting Sink | Professional Cloud DevOps Engineer

Gcp Centralized Log Aggregation Intercepting Sink

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization needs to centralize logging across all current and future projects into a dedicated project named logging-prod.

The design must meet the following requirements:

Automatically capture logs across all folders and child projects under the organization resource.
Aggregate all Data Access audit logs into a custom, centralized Log Bucket located in logging-prod.
Prevent Data Access audit logs from being duplicated in the originating projects' _Default log buckets to control storage costs, while ensuring mandatory system audit logs remain stored in each originating project's _Required bucket.
Ensure the log routing mechanism adheres to supported destination constraints and uses the least privilege necessary.

Which logging architecture should you implement?

Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags, set the sink destination directly to the custom Log Bucket URI in logging-prod, and grant the Logs Bucket Writer role.

Create a non-intercepting aggregated log sink at the organization level with the include-children flag targeting the custom Log Bucket URI in logging-prod directly, and grant the sink's writerIdentity the Logs Bucket Writer role on the destination project.

Create an intercepting aggregated log sink at the organization level with the include-children and intercept-children flags set to route logs to the logging-prod project, configure a log sink in logging-prod to route incoming entries into the custom Log Bucket, and grant the aggregated sink's writerIdentity the Logs Writer role on logging-prod.

Deploy individual project-level log sinks across all existing projects to route Data Access logs to logging-prod, and disable the system-created _Default sink in every child project using default resource settings.

Professional Cloud DevOps Engineer

Gcp Centralized Log Aggregation Intercepting Sink

Related questions