A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements: All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates. Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability. Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days. Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data. Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.: What this solution is This solution implements an enterprise-grade log retention, archival, and access control architecture by combining aggregated Cloud Logging sinks, Cloud Storage Object Lifecycle Management, Cloud Storage Bucket Lock, and granular Identity and Access Management (IAM) roles. How it meets the requirements 5-Year Regulatory Retention and WORM Protection: Cloud Storage Bucket Lock allows organizations to define an immutable retention policy (1,825 days / 5 years). Once locked, the retention policy cannot be shortened or deleted by any identity, including Project Owners and Google Cloud administrators, ensuring strict Write-Once-Read-Many (WORM) compliance. Cost-Effective Archival: Cloud Storage Object Lifecycle Management with the SetStorageClass action automatically inspects object age conditions and transitions data from Standard storage to Coldline storage after 90 days, significantly reducing long-term storage expenditures for infrequently accessed audit records. Least Privilege Access Controls: Enabling Uniform Bucket-Level Access (UBLA) unifies permissions under IAM and disables object ACLs. Granting roles/storage.objectViewer gives auditors read-only access to inspect log objects while strictly withholding write, delete, and policy modification privileges (storage.buckets.setIamPolicy). Centralized Organization Coverage: An organization-level aggregated sink captures both Admin Activity and Data Access audit logs across all existing and future child folders and projects. Key advantages Tamper-Proof Immutability: Guarantees compliance with strict financial industry regulations (e.g., SEC Rule 17a-4, FINRA, HIPAA). Automated Cost Optimization: Eliminates manual intervention to migrate multi-terabyte log archives across storage tiers. Centralized IAM Governance: Uniform Bucket-Level Access prevents permission fragmentation caused by object-level ACLs. Separation of Duties: Separates logging infrastructure administrators from compliance auditors. Why this is optimal Using Cloud Storage with Bucket Lock and Object Lifecycle Management provides a fully managed, compliant, and cost-effective long-term archival solution that exceeds the operational capabilities of standard log buckets while strictly enforcing least privilege.

Tamper-Proof 5-Year Audit Logs With Bucket Lock

WORM Audit Log Retention With Bucket Lock

A financial enterprise is designing a centralized logging and compliance architecture across all Google Cloud projects in its organization. The compliance and security teams have established the following requirements:

All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates.
Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability.
Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days.
Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data.

Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.

Explanations

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

What this option is/does

This option builds a custom, unmanaged log processing pipeline using Cloud Pub/Sub, a Compute Engine VM, local persistent disks, and custom shell scripts to push log archives to Cloud Storage.

Why it doesn't meet the requirement

Operational Overhead and Single Point of Failure: Using an unmanaged Compute Engine VM introduces maintenance overhead, scaling bottlenecks, patching requirements, and points of failure for critical regulatory log collection.
Lack of Native WORM and Lifecycle Automation: It attempts to manage storage tiering via cron scripts rather than utilizing Google Cloud's built-in Object Lifecycle Management engine, and it omits required Bucket Lock retention enforcement.
Security and Access Control Gaps: iptables firewall rules protect host network sockets on the VM but do not enforce least-privilege IAM controls over the destination storage archive or prevent unauthorized bucket operations.

Key characteristics and limitations

Custom log forwarding scripts can fail silently, leading to compliance violations and lost audit trails.
Direct Cloud Logging sinks to Cloud Storage are fully managed, highly available, and automatically partitioned by date without intermediary VMs.
Host-level controls cannot substitute for cloud-native IAM and Bucket Lock policies.

This answer would be correct if

The enterprise required custom stream transformation, heavy on-the-fly log enrichment, or third-party proprietary hashing on-premises before data reached cloud storage.

View source documentation

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

What this option is/does

This option exports audit logs to BigQuery for structured analytical querying, using table partition expiration for retention and BigQuery column-level security for access control.

Why it doesn't meet the requirement

No Coldline Storage Migration: BigQuery table snapshots and partitioned tables reside within BigQuery managed storage (Active and Long-term physical/logical tiers); they cannot be natively targeted or transitioned using Cloud Storage lifecycle classes like Coldline or Archive.
Lack of WORM Immutability Protection: Table partition expiration in BigQuery automatically deletes partitions older than the specified duration, but partition expiration is mutable and does not provide irreversible WORM Bucket Lock compliance against administrative truncation or dataset deletion.
Higher Operational and Storage Cost: Storing high-volume Data Access audit logs in BigQuery for five years is significantly more expensive than archiving compressed log blobs in Cloud Storage Coldline.

Key characteristics and limitations

BigQuery storage automatically transitions to BigQuery Long-Term storage after 90 days of no modifications, but this is distinct from Cloud Storage Coldline.
BigQuery partition expiration drops data rather than archiving it.
Column-level access controls manage schema visibility within SQL queries rather than managing raw audit archive files.

This answer would be correct if

The primary goal was performing continuous, complex SQL security analytics over multi-year audit history without cold-storage archival constraints.

View source documentation

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

What this option is/does

This option attempts to manage 5-year retention and access controls exclusively within native Cloud Logging log buckets (_Default and _Required) without exporting data to Cloud Storage.

Why it doesn't meet the requirement

No Automatic Coldline Tiering in Log Buckets: Cloud Logging log buckets do not support storage class transitions or automated lifecycle tiering into Cloud Storage classes such as Coldline or Archive. Ingestion and storage within Cloud Logging buckets follow flat per-GiB pricing without cold-tier discounts.
No WORM Bucket Lock Mechanism: While log buckets support custom retention durations up to 3,650 days, they do not support Cloud Storage Bucket Lock (WORM enforcement) to irreversibly lock the retention policy against administrative modification or reduction.
Misunderstanding of Field-Level Access: Field-level access controls are designed to redact individual fields (such as PII) within LogEntry payloads, not to prevent log bucket deletion or manage storage lifecycle transitions.

Key characteristics and limitations

Cloud Logging retention applies a flat retention rule across all logs in the bucket.
Custom retention cannot be configured on the built-in _Required bucket beyond its fixed 400-day period.
Log buckets cannot transition data into secondary object storage tiers.

This answer would be correct if

The requirement was to retain logs for up to 10 years directly within the Logging query engine for real-time Log Analytics without requiring cold-storage lifecycle transitions or WORM immutability.

View source documentation

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.

What this solution is

This solution implements an enterprise-grade log retention, archival, and access control architecture by combining aggregated Cloud Logging sinks, Cloud Storage Object Lifecycle Management, Cloud Storage Bucket Lock, and granular Identity and Access Management (IAM) roles.

How it meets the requirements

5-Year Regulatory Retention and WORM Protection: Cloud Storage Bucket Lock allows organizations to define an immutable retention policy (1,825 days / 5 years). Once locked, the retention policy cannot be shortened or deleted by any identity, including Project Owners and Google Cloud administrators, ensuring strict Write-Once-Read-Many (WORM) compliance.
Cost-Effective Archival: Cloud Storage Object Lifecycle Management with the SetStorageClass action automatically inspects object age conditions and transitions data from Standard storage to Coldline storage after 90 days, significantly reducing long-term storage expenditures for infrequently accessed audit records.
Least Privilege Access Controls: Enabling Uniform Bucket-Level Access (UBLA) unifies permissions under IAM and disables object ACLs. Granting roles/storage.objectViewer gives auditors read-only access to inspect log objects while strictly withholding write, delete, and policy modification privileges (storage.buckets.setIamPolicy).
Centralized Organization Coverage: An organization-level aggregated sink captures both Admin Activity and Data Access audit logs across all existing and future child folders and projects.

Key advantages

Tamper-Proof Immutability: Guarantees compliance with strict financial industry regulations (e.g., SEC Rule 17a-4, FINRA, HIPAA).
Automated Cost Optimization: Eliminates manual intervention to migrate multi-terabyte log archives across storage tiers.
Centralized IAM Governance: Uniform Bucket-Level Access prevents permission fragmentation caused by object-level ACLs.
Separation of Duties: Separates logging infrastructure administrators from compliance auditors.

Why this is optimal

Using Cloud Storage with Bucket Lock and Object Lifecycle Management provides a fully managed, compliant, and cost-effective long-term archival solution that exceeds the operational capabilities of standard log buckets while strictly enforcing least privilege.

View source documentation

Last updated August 28, 2026Validated August 28, 2026

WORM Audit Log Retention With Bucket Lock

All Admin Activity and Data Access audit logs must be retained for 5 years (1,825 days) to meet regulatory retention mandates.
Audit logs must be protected against tampering, early deletion, and unauthorized modification using write-once-read-many (WORM) immutability.
Log storage costs must be optimized by automatically transitioning older log data to Coldline storage after 90 days.
Security auditors must have read-only access to view the archived log objects without being able to modify access policies or delete data.

Which logging and storage strategy should the enterprise implement to satisfy these requirements?

Explanations

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

What this option is/does

Why it doesn't meet the requirement

Operational Overhead and Single Point of Failure: Using an unmanaged Compute Engine VM introduces maintenance overhead, scaling bottlenecks, patching requirements, and points of failure for critical regulatory log collection.
Lack of Native WORM and Lifecycle Automation: It attempts to manage storage tiering via cron scripts rather than utilizing Google Cloud's built-in Object Lifecycle Management engine, and it omits required Bucket Lock retention enforcement.
Security and Access Control Gaps: iptables firewall rules protect host network sockets on the VM but do not enforce least-privilege IAM controls over the destination storage archive or prevent unauthorized bucket operations.

Key characteristics and limitations

Custom log forwarding scripts can fail silently, leading to compliance violations and lost audit trails.
Direct Cloud Logging sinks to Cloud Storage are fully managed, highly available, and automatically partitioned by date without intermediary VMs.
Host-level controls cannot substitute for cloud-native IAM and Bucket Lock policies.

This answer would be correct if

The enterprise required custom stream transformation, heavy on-the-fly log enrichment, or third-party proprietary hashing on-premises before data reached cloud storage.

View source documentation

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

What this option is/does

This option exports audit logs to BigQuery for structured analytical querying, using table partition expiration for retention and BigQuery column-level security for access control.

Why it doesn't meet the requirement

No Coldline Storage Migration: BigQuery table snapshots and partitioned tables reside within BigQuery managed storage (Active and Long-term physical/logical tiers); they cannot be natively targeted or transitioned using Cloud Storage lifecycle classes like Coldline or Archive.
Lack of WORM Immutability Protection: Table partition expiration in BigQuery automatically deletes partitions older than the specified duration, but partition expiration is mutable and does not provide irreversible WORM Bucket Lock compliance against administrative truncation or dataset deletion.
Higher Operational and Storage Cost: Storing high-volume Data Access audit logs in BigQuery for five years is significantly more expensive than archiving compressed log blobs in Cloud Storage Coldline.

Key characteristics and limitations

BigQuery storage automatically transitions to BigQuery Long-Term storage after 90 days of no modifications, but this is distinct from Cloud Storage Coldline.
BigQuery partition expiration drops data rather than archiving it.
Column-level access controls manage schema visibility within SQL queries rather than managing raw audit archive files.

This answer would be correct if

The primary goal was performing continuous, complex SQL security analytics over multi-year audit history without cold-storage archival constraints.

View source documentation

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

What this option is/does

This option attempts to manage 5-year retention and access controls exclusively within native Cloud Logging log buckets (_Default and _Required) without exporting data to Cloud Storage.

Why it doesn't meet the requirement

No Automatic Coldline Tiering in Log Buckets: Cloud Logging log buckets do not support storage class transitions or automated lifecycle tiering into Cloud Storage classes such as Coldline or Archive. Ingestion and storage within Cloud Logging buckets follow flat per-GiB pricing without cold-tier discounts.
No WORM Bucket Lock Mechanism: While log buckets support custom retention durations up to 3,650 days, they do not support Cloud Storage Bucket Lock (WORM enforcement) to irreversibly lock the retention policy against administrative modification or reduction.
Misunderstanding of Field-Level Access: Field-level access controls are designed to redact individual fields (such as PII) within LogEntry payloads, not to prevent log bucket deletion or manage storage lifecycle transitions.

Key characteristics and limitations

Cloud Logging retention applies a flat retention rule across all logs in the bucket.
Custom retention cannot be configured on the built-in _Required bucket beyond its fixed 400-day period.
Log buckets cannot transition data into secondary object storage tiers.

This answer would be correct if

The requirement was to retain logs for up to 10 years directly within the Logging query engine for real-time Log Analytics without requiring cold-storage lifecycle transitions or WORM immutability.

View source documentation

Create an organization-level aggregated logging sink to route all audit logs to a centralized Cloud Storage bucket, configure Uniform Bucket-Level Access, apply an Object Lifecycle Management rule with the SetStorageClass action targeting Coldline after 90 days, enable a locked retention policy using Bucket Lock for 1,825 days, and grant auditors the Storage Object Viewer (roles/storage.objectViewer) IAM role.

What this solution is

How it meets the requirements

5-Year Regulatory Retention and WORM Protection: Cloud Storage Bucket Lock allows organizations to define an immutable retention policy (1,825 days / 5 years). Once locked, the retention policy cannot be shortened or deleted by any identity, including Project Owners and Google Cloud administrators, ensuring strict Write-Once-Read-Many (WORM) compliance.
Cost-Effective Archival: Cloud Storage Object Lifecycle Management with the SetStorageClass action automatically inspects object age conditions and transitions data from Standard storage to Coldline storage after 90 days, significantly reducing long-term storage expenditures for infrequently accessed audit records.
Least Privilege Access Controls: Enabling Uniform Bucket-Level Access (UBLA) unifies permissions under IAM and disables object ACLs. Granting roles/storage.objectViewer gives auditors read-only access to inspect log objects while strictly withholding write, delete, and policy modification privileges (storage.buckets.setIamPolicy).
Centralized Organization Coverage: An organization-level aggregated sink captures both Admin Activity and Data Access audit logs across all existing and future child folders and projects.

Key advantages

Tamper-Proof Immutability: Guarantees compliance with strict financial industry regulations (e.g., SEC Rule 17a-4, FINRA, HIPAA).
Automated Cost Optimization: Eliminates manual intervention to migrate multi-terabyte log archives across storage tiers.
Centralized IAM Governance: Uniform Bucket-Level Access prevents permission fragmentation caused by object-level ACLs.
Separation of Duties: Separates logging infrastructure administrators from compliance auditors.

Why this is optimal

View source documentation

Last updated August 28, 2026Validated August 28, 2026

WORM Audit Log Retention With Bucket Lock

Explanations

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

What this solution is

How it meets the requirements

Key advantages

Why this is optimal

Try 10 interactive questions like this one, free

Related questions

Organization Aggregated Log Sinks

Google SecOps UDM and YARA-L

STS Data Access Audit Logs

On-Demand Scanning Pre-Push Gating

restricted.googleapis.com VIP with Private Google Access

PSC NEG with Cloud DNS Inbound Server Policy

WORM Audit Log Retention With Bucket Lock

Explanations

Create an export sink routing logs to a Cloud Pub/Sub topic, subscribe a Compute Engine VM that writes logs to persistent disks, run a nightly cron job using gsutil to compress and upload files to Coldline storage, and apply iptables firewall rules to restrict VM access.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

Create a Cloud Logging export sink to route audit logs to a BigQuery dataset, configure table partition expiration to 1,825 days, apply column-level access control on the dataset, and configure scheduled table snapshots to move partitioned tables into Coldline storage.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

Configure a custom retention period of 1,825 days directly on the organization's _Default and _Required Cloud Logging buckets, configure field-level access controls to restrict deletion permissions, and rely on automatic Cloud Logging tiering to migrate older logs to Coldline storage.

What this option is/does

Why it doesn't meet the requirement

Key characteristics and limitations

This answer would be correct if

What this solution is

How it meets the requirements

Key advantages

Why this is optimal

Try 10 interactive questions like this one, free

Related questions

Organization Aggregated Log Sinks

Google SecOps UDM and YARA-L

STS Data Access Audit Logs

On-Demand Scanning Pre-Push Gating

restricted.googleapis.com VIP with Private Google Access

PSC NEG with Cloud DNS Inbound Server Policy