A software-as-a-service (SaaS) provider needs to demonstrate to its enterprise customers that even Google Cloud administrators cannot access their highly sensitive data without explicit, auditable approval. This is a critical compliance requirement for their service. They have already implemented Access Approval. Which additional Google Cloud service provides detailed, immutable logs of any actual access by Google personnel, including the justification and identity, to fulfill the audit requirements?
- ACloud Logging
- BSecurity Command Center Premium
- CCloud Audit Logs
- DAccess Transparency
Show answer & explanationAnswer & explanation
Correct answer: D. Access Transparency
Access Transparency provides detailed, immutable logs of actions taken by Google Cloud personnel when they access customer data or configurations. While Access Approval ensures explicit consent *before* access, Access Transparency provides the *proof* of what happened *during* access, including the Google employee's identity and the justification, which is crucial for meeting stringent audit requirements for sensitive data and demonstrating 'no unauthorized access by Google'. This complements Access Approval by providing the 'what happened' after 'permission was granted'.
Why the other options are wrong
- A. Cloud Logging is a general-purpose logging service; Access Transparency specifically generates the detailed logs of Google personnel access.
- B. Security Command Center Premium is for advanced threat detection and vulnerability management, not for logging Google personnel access to customer data.
- C. Cloud Audit Logs records actions taken by *customer* users and services, not specifically Google personnel accessing customer data with the required detail.
Access Transparency (Audit Proof)
A Google Cloud service that generates detailed, immutable audit logs of Google Cloud personnel's administrative access to customer data and configurations, including identity and explicit justification.
- Provides auditable proof of Google's internal access.
- Complements Access Approval by logging *after* consent.
- Crucial for demonstrating 'no unauthorized access' to regulators.
Memory trick: Access Approval is the 'Gatekeeper', and Access Transparency is the 'Security Camera' that watches the gatekeeper.