Secure Log Export Cmek Vpcsc

What this solution is

This solution implements a defense-in-depth security model for log export pipelines by combining least-privilege IAM roles, Customer-Managed Encryption Keys (CMEK), and VPC Service Controls (VPC SC) perimeters to safeguard telemetry egress paths.

How it meets the requirements

• Least-privilege IAM for sink writer identity: Cloud Logging sinks generate a dedicated service account identity (the writerIdentity). Granting only roles/storage.objectCreator on the destination bucket allows the Log Router to upload exported log objects without granting read, list, or overwrite capabilities over existing audit records.
• CMEK on storage destination: Cloud Storage encrypts objects using the bucket's default KMS key. Cloud Storage uses its own regional service agent (service-PROJECT_NUMBER@gs-project-accounts.iam.gserviceaccount.com) to encrypt and decrypt objects, requiring the roles/cloudkms.cryptoKeyEncrypterDecrypter role granted specifically to this service agent.
• Perimeter egress protection: Adding both the originating projects and the destination security project into a common VPC Service Controls perimeter (or bridging them via perimeter egress/ingress policies) while restricting APIs like storage.googleapis.com and cloudkms.googleapis.com ensures that log data cannot be exfiltrated to unauthorized cloud projects or external destinations.

Key advantages and capabilities

• Cryptographic control: Revoking or disabling the KMS key immediately denies access to data stored in the CMEK-encrypted destination bucket.
• Tamper resistance: Restricting the sink identity to roles/storage.objectCreator prevents compromised sinks from altering or deleting historical logs.
• Exfiltration boundary: The VPC SC boundary enforces perimeter-level API controls across all user and service identities.
• Compliance alignment: Meets regulatory standards requiring customer key ownership and segmented audit log storage.

Why this is optimal

This approach adheres strictly to Google Cloud security best practices by granting the exact minimal permissions required for both the Log Router sink writer identity and the Cloud Storage CMEK service agent, while eliminating unauthorized perimeter egress.