An enterprise financial organization needs to implement a least privilege access model for analyzing telemetry in Google Cloud Logging while complying with strict audit controls: Application Developers must be able to view standard operational and system logs for troubleshooting, but must be strictly blocked from viewing sensitive Data Access audit logs. Compliance Auditors must have read-only permissions to inspect all logs, specifically including Data Access audit logs. Network Boundary Restriction: Compliance Auditors must only be permitted to query these sensitive audit logs when connecting from verified corporate IP ranges. Administrative Protection: Neither developers nor auditors should have permissions to delete logs, configure log sinks, or modify log bucket retention policies. Which strategy should the cloud security engineer implement to satisfy these security requirements?

Grant developers the Logs Viewer (roles/logging.viewer) role, grant auditors the Private Logs Viewer (roles/logging.privateLogViewer) role, and attach an IAM Condition with an Access Context Manager access level to the auditor role binding.: ### What the solution is This solution pairs Google Cloud's predefined logging IAM roles with context-aware access controls to enforce strict least privilege and network boundary segregation. The **Logs Viewer** (`roles/logging.viewer`) role grants access to view standard logs while restricting access to private logs, whereas the **Private Logs Viewer** (`roles/logging.privateLogViewer`) role provides read-only access to all log types, including sensitive Data Access audit logs. Applying an **Access Context Manager** condition to the auditor's IAM role binding ensures access is constrained by client network context. ### How it meets the requirements - **Least privilege for developers**: The **Logs Viewer** role provides developers with visibility into standard application and infrastructure logs while excluding permissions to read sensitive Data Access audit logs. - **Audit log inspection**: The **Private Logs Viewer** role grants compliance auditors the elevated `logging.privateLogEntries.list` permission required to read Data Access audit logs without conferring administrative privileges. - **Network boundary restriction**: An **IAM Condition** evaluating `request.auth.access_levels` references an Access Context Manager perimeter/access level, guaranteeing that queries to private audit logs succeed only when originating from approved corporate IP blocks. - **Administrative protection**: Neither role includes write or modification permissions (such as `logging.sinks.*` or `logging.buckets.update`), protecting log configuration and retention integrity. ### Key advantages and capabilities - **Predefined role alignment**: Avoids custom role maintenance while adhering to Google Cloud's native separation of standard vs. private audit logs. - **Contextual authorization**: Enforces zero-trust contextual boundaries dynamically at the IAM evaluation layer. - **Tamper resistance**: Preserves audit integrity by withholding log sink and bucket administration privileges. - **Fine-grained auditing**: Enables granular access tracking across operational telemetry and security audit logs. ### Why this is optimal This approach cleanly separates standard application telemetry from sensitive Data Access logs at the IAM layer without provisioning unnecessary administrative powers, while simultaneously applying robust geographic and network-based contextual guardrails.

Iam Roles Private Logs Viewer Perimeter Boundaries | Professional Cloud Security Engineer

Iam Roles Private Logs Viewer Perimeter Boundaries

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise financial organization needs to implement a least privilege access model for analyzing telemetry in Google Cloud Logging while complying with strict audit controls:

Application Developers must be able to view standard operational and system logs for troubleshooting, but must be strictly blocked from viewing sensitive Data Access audit logs.
Compliance Auditors must have read-only permissions to inspect all logs, specifically including Data Access audit logs.
Network Boundary Restriction: Compliance Auditors must only be permitted to query these sensitive audit logs when connecting from verified corporate IP ranges.
Administrative Protection: Neither developers nor auditors should have permissions to delete logs, configure log sinks, or modify log bucket retention policies.

Which strategy should the cloud security engineer implement to satisfy these security requirements?

Grant both developers and auditors the Logs Viewer (roles/logging.viewer) role, and grant auditors the Logging Admin (roles/logging.admin) role with an IAM Condition restricting access to corporate IP ranges.

Grant both developers and auditors the Private Logs Viewer (roles/logging.privateLogViewer) role, and configure a VPC Service Controls perimeter ingress rule allowing developer traffic from corporate IP ranges.

Grant developers the Logs Viewer (roles/logging.viewer) role, grant auditors the Private Logs Viewer (roles/logging.privateLogViewer) role, and attach an IAM Condition with an Access Context Manager access level to the auditor role binding.

Grant developers the Logs Viewer (roles/logging.viewer) role and grant auditors the Logs Configuration Writer (roles/logging.configWriter) role with an Access Context Manager condition.

Professional Cloud Security Engineer

Iam Roles Private Logs Viewer Perimeter Boundaries

Related questions