Your enterprise organization needs to establish automated governance and compliance guardrails across its Google Cloud CI/CD pipeline infrastructure. The DevOps security policy mandates that: Any configuration drift or unauthorized modifications to IAM policies, custom roles, and service account keys must be audited immediately. Audit log events indicating pipeline infrastructure modifications must automatically trigger event-driven validation and remediation workflows without periodic polling. Which architectural pattern should you implement to meet these requirements?

Capture Admin Activity audit logs (`cloudaudit.googleapis.com/activity`) and IAM service events (`iam.googleapis.com`), and route them via Eventarc triggers directly to Cloud Workflows for automated policy validation and drift remediation.: ### What Eventarc and Cloud Audit Logs Integration Is **Cloud Audit Logs** captures administrative operations and security-sensitive configuration modifications across Google Cloud resources, including **Identity and Access Management (IAM)** and CI/CD tooling. **Eventarc** provides a fully-managed, event-driven architecture that reads Cloud Audit Log entries in real time and routes them to target services such as **Cloud Workflows** or **Cloud Run** without requiring polling infrastructure. ### How It Meets the Requirements - **Real-Time Drift Detection**: Capturing `cloudaudit.googleapis.com/activity` log entries for `iam.googleapis.com` ensures immediate detection when service accounts, keys, or IAM policy bindings (`SetIamPolicy`, `CreateServiceAccountKey`) are created, updated, or deleted. - **Event-Driven Policy Validation**: Routing these audit log events through **Eventarc** directly into **Cloud Workflows** allows organizations to execute Policy-as-Code checks and trigger automated remediation steps asynchronously and instantaneously as changes occur. ### Key Advantages and Capabilities - **Zero Polling Overhead**: Eliminates latency and resource waste associated with scheduled batch queries against logging sinks. - **Native Audit Log Filtering**: Allows precise filtering on specific API methods like `SetIamPolicy`, `CreateRole`, or `UpdatePipeline`. - **Orchestrated Remediation**: **Cloud Workflows** handles complex, stateful multi-step compliance evaluations, approval steps, and rollbacks. - **High Security Standard**: Leverages native Google Cloud control-plane security and IAM-backed trigger invocations. ### Why This Is Optimal This architecture directly couples Google Cloud's native auditing plane with an event-driven automation framework. It enforces real-time governance, prevents security drift from persisting, and meets organizational compliance guardrails with minimal operational complexity.

Govern Cicd Audit Logging Eventarc Workflows | Professional Cloud DevOps Engineer

Govern Cicd Audit Logging Eventarc Workflows

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your enterprise organization needs to establish automated governance and compliance guardrails across its Google Cloud CI/CD pipeline infrastructure. The DevOps security policy mandates that:

Any configuration drift or unauthorized modifications to IAM policies, custom roles, and service account keys must be audited immediately.
Audit log events indicating pipeline infrastructure modifications must automatically trigger event-driven validation and remediation workflows without periodic polling.

Which architectural pattern should you implement to meet these requirements?

Configure scheduled Cloud Scheduler jobs to run hourly Google Security Operations queries, exporting Confluence and Cloud Storage logs to detect IAM changes and invoke pipelines.

Enable Data Access audit logs exclusively for datapipelines.googleapis.com and export them to a Cloud Storage bucket with Object Versioning for manual compliance analysis.

Assign the default Compute Engine service account with the basic Editor role to run Cloud Composer DAGs that continuously poll Cloud Logging buckets for drift.

Capture Admin Activity audit logs (cloudaudit.googleapis.com/activity) and IAM service events (iam.googleapis.com), and route them via Eventarc triggers directly to Cloud Workflows for automated policy validation and drift remediation.

Professional Cloud DevOps Engineer

Govern Cicd Audit Logging Eventarc Workflows

Related questions