Restricted Log Views for Cross-Project Log Access in Cloud Logging
You are managing logging for your organization by aggregating logs into a centralized Google Cloud project. The aggregated logs come from two source projects: one for a frontend application and one for a backend application. You need to grant the frontend development team access to view all logs originating from the frontend project and only error-level logs from the backend project. The team must not be able to view any other logs. You want to follow the principle of least privilege and develop a cost-efficient solution. What should you do?
Community Insight
The question tests enforced, IAM-enforced log filtering versus advisory filtering — the trap is choosing query sharing or developer instructions, which cannot restrict what a user actually reads once they have broader role grants.
This ACE scenario tests how to grant least-privilege, filtered access to aggregated logs in a centralized Google Cloud Logging project. The correct approach uses a log view scoped with an inclusion filter (all frontend logs plus only ERROR-level backend logs) and grants the frontend team the logging.viewAccessor IAM role on that specific view.
Option C is the most tempting wrong answer: granting logging.viewer on both projects and merely instructing developers to apply a filter. This violates least privilege because the filter is optional — the team could remove it and read everything, including non-error backend logs.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option D uses Cloud Logging log views, the purpose-built mechanism for granting filtered access to logs in a bucket or log range. A log view applies a server-side inclusion filter — here, all logs from the frontend project plus only logs with severity ERROR from the backend project — so the restriction is enforced by IAM, not by user discipline. Granting logging.viewAccessor (View Accessor) on that specific view lets the frontend team read only what the view exposes, exactly satisfying least privilege. Because the logs stay in the existing aggregation bucket rather than being duplicated to a new destination, the solution is also cost-efficient, avoiding extra storage and ingestion of duplicated log data.Why the Other Options Are Wrong
Option A merely saves and shares a Logs Explorer query and asks the team "not to use any other query" — a shared query is advisory, not enforced; anyone with broader viewer access could run any other query. Option B creates two additional log sinks routing data to a new Cloud Storage bucket, which duplicates log storage, increases cost, and complicates the pipeline; also, plain bucket read access does not give structured Logs Explorer querying the way log views do. Option C grants logging.viewer on the entire backend project, which is broader than needed and relies on developers voluntarily applying a filter, breaking least privilege.Community Comment Notes
The single community comment agrees with this analysis, stating simply "answer=D" and reiterating the log view plus logging.viewAccessor approach. No one defended the query-sharing or instruction-based options, reflecting broad recognition that only a log view enforces the filter at the IAM layer.Official Reference
Exam Strategy
When a question demands least-privilege access to a subset of aggregated logs, look for a log view with a scoped inclusion filter plus logging.viewAccessor — anything relying on users following instructions or shared queries is not enforced and is therefore wrong.
Frequently Asked Questions
Why is sharing a Logs Explorer query not a valid access-control method?
A shared query only filters what a user chooses to run; anyone with broader logging.viewer access can simply change or clear the query and read logs the team should not see.
Why is logging.viewAccessor used instead of logging.viewer here?
logging.viewAccessor grants read access only to logs exposed by the specific log view, while logging.viewer grants read access to all logs in the project or scope, which violates least privilege.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →