Isolate Service Integration Iam Vpc Audit Logs

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A production microservice running on Cloud Run begins throwing intermittent HTTP 403 Forbidden runtime exceptions when attempting to integrate with downstream Google Cloud storage services. A recent security update introduced both VPC Service Controls perimeters and revised identity policies across service accounts. You need to isolate whether the integration failures originate from service account IAM permission gaps or VPC Service Controls perimeter restrictions, while identifying the exact caller identity and requested method.

Which troubleshooting strategy should you use to isolate the root cause?

Query Cloud Audit Logs using structured log filtering to analyze protopayload_auditlog attributes, including authenticationInfo.principalEmail, methodName, resource.labels.service, and metadataJson.violationReason.

Apply the iam.disableServiceAccountKeyCreation organization policy constraint across the folder to force Cloud Run to use short-lived OAuth tokens.

Review Cloud Infrastructure Entitlement Management (CIEM) in Security Command Center to automatically revoke unused roles from federated identities.

Inspect Event Threat Detection findings for the 'Persistence: Unmanaged Account Granted Sensitive Role' threat category to identify privilege escalations.

Professional Cloud DevOps Engineer

Isolate Service Integration Iam Vpc Audit Logs

Related questions