Gcp Centralized Log Aggregation Intercepting Sink

What an Intercepting Aggregated Sink Is

An intercepting aggregated log sink is an organization-level or folder-level routing rule configured in Cloud Logging that captures log entries from the parent resource and all child resources. Unlike non-intercepting sinks, an intercepting sink halts the downstream evaluation of matching log entries in child resources, preventing them from being processed by child-level sinks (such as the system-created _Default sink) while still guaranteeing delivery to the originating project's _Required sink.

How It Meets the Requirements

• Captures all current and future projects: Configuring the aggregated sink at the organization root with --include-children automatically encompasses all existing and newly created folders and projects without manual intervention.
• Prevents duplicate storage and controls costs: By using --intercept-children (or setting interceptChildren: true), matching Data Access logs are intercepted and withheld from project-level _Default sinks, avoiding duplicate ingestion charges across hundreds of projects.
• Preserves mandatory audit logs: Intercepting sinks never block delivery to the _Required log sink in the originating resource, ensuring Admin Activity and System Event logs remain compliant at the project boundary.
• Adheres to destination constraints and IAM: Cloud Logging requires that the destination of an intercepting aggregated sink must be a Google Cloud project. Sinks within the destination project (logging-prod) then reroute the entries into storage repositories like custom Log Buckets. Granting Logs Writer (roles/logging.logWriter) to the sink's generated writerIdentity service account satisfies least-privilege destination access.

Key Advantages and Capabilities

• Centralized Ingestion Control: Eliminates the operational overhead of modifying individual project configurations across the organization.
• Architectural Scalability: Future-proofs log collection as new projects and folders are provisioned dynamically.
• Cost Efficiency: Eliminates redundant log ingestion and storage charges caused by dual routing in originating and central projects.
• Granular Rerouting: Allows the destination project to further route, filter, or create log views across various organizational domains.

Why This Is Optimal

This architecture is the only design that strictly complies with Google Cloud's routing model: intercepting aggregated sinks must terminate at a project destination, where local sinks manage secondary delivery to custom Log Buckets while protecting child projects from double-storage costs.