A financial enterprise requires a centralized, tamper-proof audit logging architecture across all Google Cloud projects within its organization. The compliance and security teams mandate the following technical requirements: Centralization: All organization-wide audit logs must be routed to a centralized Cloud Storage bucket residing in a dedicated sec-logging-prod project. Tamper resistance: Project administrators in individual child projects must not be able to disable or alter the logging pipeline. Data at rest: All exported log objects must be encrypted using a customer-managed encryption key (CMEK). Immutability: Logs must be protected against modification, overwriting, and deletion for a minimum compliance retention period of seven years (WORM compliance). Which architecture and set of configuration steps should the security engineer implement?

Create an aggregated log sink at the organization level with `--include-children` pointing to the storage bucket in `sec-logging-prod`. Grant the sink's `writerIdentity` the Storage Object Creator role (`roles/storage.objectCreator`) on the destination bucket, assign the Cloud KMS CryptoKey Encrypter/Decrypter role (`roles/cloudkms.cryptoKeyEncrypterDecrypter`) to the Cloud Storage service agent on the CMEK key, and enforce a 7-year locked retention policy using Bucket Lock.: What the solution is This architecture establishes an aggregated log sink at the Google Cloud organization root that centrally captures and routes audit telemetry across all descendant folders and projects into a hardened, CMEK-encrypted, and WORM-compliant Cloud Storage bucket. How it meets the requirements Centralization & Child Coverage: Creating an organization-level sink configured with --include-children automatically aggregates logs across every current and future child folder and project, routing them directly to the designated Cloud Storage bucket in sec-logging-prod. Tamper Resistance: Because the sink is established at the organization node, project-level administrators lack the IAM permissions required to update, disable, or delete the sink at the root level. Least-Privilege Routing Permissions: Granting roles/storage.objectCreator to the sink's unique writerIdentity service account allows Cloud Logging to write new log objects to the destination bucket without granting unnecessary read or delete capabilities. CMEK Encryption: Binding roles/cloudkms.cryptoKeyEncrypterDecrypter to the Cloud Storage service agent ensures all incoming log objects written to the bucket are encrypted using customer-controlled keys in Cloud KMS. WORM Immutability: Applying a 7-year retention policy and permanently locking it with Cloud Storage Bucket Lock prevents any user—including Organization Administrators and Project Owners—from modifying or deleting log objects until the retention timer has elapsed. Key advantages Unified governance: Automatically incorporates new projects into audit pipelines without manual onboarding. Strict separation of duties: Keeps audit storage under dedicated security administrators. Cryptographic control: Allows key rotation, disabling, or destruction in Cloud KMS. Immutable compliance: Meets strict SEC 17a-4, FINRA, and GDPR regulatory audit standards. Why this is optimal Aggregated sinks configured at the organization root combined with locked bucket retention policies and CMEK provide an end-to-end zero-trust logging architecture that completely isolates security records from individual workload owners.