Aggregated Log Sink Tamper Proof Architecture

What this solution is

This solution uses a Google Cloud aggregated log sink at the organization level combined with least-privilege IAM permissions and regional Cloud Storage configuration to deliver a centralized, secure, and compliant log repository.

How it meets the requirements

• Comprehensive audit coverage: Creating an aggregated sink at the organization root with the --include-children flag guarantees that all current and future child folders and projects automatically export their audit logs without requiring manual sink deployment per project.
• Data residency: Setting the Cloud Storage bucket location specifically to europe-west3 in a dedicated logging project guarantees that log archives remain stored within the mandated regulatory boundaries.
• Tamper resistance and least privilege: Cloud Logging generates a dedicated writer identity (a service account) for the sink. Granting this identity only roles/storage.objectCreator ensures write-only access—the writer identity can upload (storage.objects.create) new log objects but cannot read, overwrite, or delete existing log entries. Furthermore, centralizing storage in a restricted security project isolates logs from child project administrators.

Key advantages and capabilities

• Write-only permissions: The roles/storage.objectCreator role prevents log exfiltration (no read permissions) and log tampering (no overwrite or delete permissions).
• Centralized governance: Eliminates blind spots caused by unmonitored child projects or rogue project creation.
• Separation of duties: Isolates log archives in a segregated security project managed exclusively by security/compliance teams.
• Immutability support: Can be coupled with Cloud Storage Bucket Lock (Retention Policy) for WORM (Write Once, Read Many) compliance.

Why this is optimal

This architecture satisfies all compliance and isolation requirements by leveraging native GCP aggregated log sinks and atomic IAM role assignments, eliminating administrative overhead while enforcing strict data residency and write-only integrity.