An organization processes financial transactions in Google Cloud and stores application logs in a custom Cloud Logging bucket. The JSON payloads contain general debugging data alongside sensitive customer identifiers (jsonPayload.user.ssn and jsonPayload.user.credit_card). Security requirements dictate that: General application developers must be able to view and query log entries for troubleshooting without seeing the sensitive identifiers. Only a dedicated compliance team should have permission to view the sensitive identifier fields within the log entries. Developers must not lose visibility into the non-sensitive fields of the affected log records. Which solution should the security team implement to satisfy these requirements?

Configure field-level access control on the log bucket to restrict `jsonPayload.user.ssn` and `jsonPayload.user.credit_card`, grant developers standard log viewing roles, and grant the compliance team the `roles/logging.fieldAccessor` role.: ### What Field-Level Access Control Is **Field-level access control** in Cloud Logging is a granular security mechanism that allows administrators to hide specific fields inside a `LogEntry` (such as nested paths in `jsonPayload`, `protoPayload`, or `labels`) while keeping the rest of the log entry visible to authorized users. ### How It Meets the Requirements - **Hiding sensitive identifiers without dropping log entries**: By configuring `--restricted-fields="jsonPayload.user.ssn,jsonPayload.user.credit_card"` on the target log bucket, Cloud Logging automatically redacts and denies direct queries to those exact leaf paths for unauthorized users while still returning the parent log entries. - **Differentiated role-based access**: Developers who possess standard viewing roles (such as `roles/logging.viewer` or `roles/logging.viewAccessor`) can query and inspect the unmasked payload fields in Logs Explorer. Only members of the compliance team granted the **Log Field Accessor** (`roles/logging.fieldAccessor`) role can view the restricted fields. ### Key Advantages and Capabilities - **Selective field masking**: Obscures up to 20 sensitive fields per log bucket without requiring modifications to upstream application logging code. - **Seamless query protection**: When users without `roles/logging.fieldAccessor` query logs, global searches bypass restricted field content, and returned `LogEntry` records omit the restricted values. - **Granular IAM conditions**: Access to restricted fields can be scoped down to specific buckets using standard IAM conditions. ### Why This Is Optimal Unlike log views or sink exclusion filters—which operate at the granularity of entire log entries—field-level access control allows development teams to maintain full context and operational visibility for debugging without exposing PII.

Cloud Logging Field Level Access Control Pii | Professional Cloud Security Engineer

Cloud Logging Field Level Access Control Pii

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An organization processes financial transactions in Google Cloud and stores application logs in a custom Cloud Logging bucket. The JSON payloads contain general debugging data alongside sensitive customer identifiers (jsonPayload.user.ssn and jsonPayload.user.credit_card).

Security requirements dictate that:

General application developers must be able to view and query log entries for troubleshooting without seeing the sensitive identifiers.
Only a dedicated compliance team should have permission to view the sensitive identifier fields within the log entries.
Developers must not lose visibility into the non-sensitive fields of the affected log records.

Which solution should the security team implement to satisfy these requirements?

Define two granular log views on the log bucket—one with a filter excluding entries containing sensitive fields for developers, and one without filter restrictions for the compliance team.

Upgrade the log bucket to use Log Analytics and create SQL views with column-masking functions to restrict access to sensitive fields.

Configure field-level access control on the log bucket to restrict jsonPayload.user.ssn and jsonPayload.user.credit_card, grant developers standard log viewing roles, and grant the compliance team the roles/logging.fieldAccessor role.

Create a Log Router sink with an exclusion filter matching jsonPayload.user.ssn and jsonPayload.user.credit_card to drop the fields during routing.

Professional Cloud Security Engineer

Cloud Logging Field Level Access Control Pii

Related questions