Google Associate Cloud EngineerConfiguring access and securityHard
A startup is building a new application that processes sensitive customer data. They need to ensure that access to this data, stored in Cloud Storage buckets, is strictly controlled and auditable. The security team requires that all data reads and writes are logged, including who accessed what data and when. Which type of audit log should be explicitly enabled and monitored for these Cloud Storage buckets?
- ASystem Event logs
- BAdmin Activity logs
- CCustom logs with specific filters
- DData Access logs (Read and Write)
Show answer & explanationAnswer & explanation
Correct answer: D. Data Access logs (Read and Write)
Data Access logs record API calls that read or write user-provided data. For sensitive data in Cloud Storage, enabling and monitoring 'Data Access logs' for both 'Read' and 'Write' operations is crucial to track who accessed what data and when, fulfilling the strict audibility requirement.
Why the other options are wrong
- A. System Event logs track actions by Google Cloud systems, not user/application data access.
- B. Admin Activity logs track configuration changes (e.g., bucket creation/deletion, IAM policy changes), not reads or writes of the data itself.
- C. While custom logs can be created, Data Access logs are the built-in, standard, and most efficient way to capture this type of audit information for Cloud Storage, making custom logs unnecessary and potentially less comprehensive for this specific need.
Data Access Logs
Audit logs that record API calls that read or write user-provided data within Google Cloud services, providing visibility into data access patterns.
- Not enabled by default for all services due to potential high volume.
- Requires explicit configuration (e.g., for Cloud Storage, BigQuery).
- Categories include ADMIN_READ, DATA_READ, and DATA_WRITE.
Memory trick: For sensitive data, enable Data Access logs to see every read and every write, ensuring audit's always right.