Restricted Log Views for Cross-Project Log Access in Cloud Logging

ACE By islever Editorial Last updated Oct 24, 2026

Monitoring and logging. Managing Identity and Access Management (IAM).

Short answer

D Create a log view on the aggregated logs bucket filtered to all frontend logs and only ERROR-level backend logs, and grant the frontend team logging.viewAccessor on that view.

Question

You are managing logging for your organization by aggregating logs into a centralized Google Cloud project. The aggregated logs come from two source projects: one for a frontend application and one for a backend application. You need to grant the frontend development team access to view all logs originating from the frontend project and only error-level logs from the backend project. The team must not be able to view any other logs. You want to follow the principle of least privilege and develop a cost-efficient solution. What should you do?

In the centralized logging project, craft a query that combines all logs from the frontend project and error-level logs from the backend project, and grant the logging.viewer IAM role. • Save and share this query with the frontend team for them to use in the Logs Explorer. • Request the frontend team not to use any other query.
Create two separate log sinks in the centralized project. • Configure one sink to route all frontend logs to a new, dedicated Cloud Storage bucket. • Configure a second sink to route only the error-level logs from the backend project to that same bucket. • Grant the frontend team read-only access to this bucket.
Grant the frontend team the logging.viewer IAM role on both the frontend project and the backend project. • Instruct the developers to use a specific filter in the Logs Explorer to find the logs they need.
In the centralized logging project, create a log view on the bucket that contains the aggregated logs. • Filter the view to include all logs from the frontend project and only logs with a severity level of ERROR from the backend project. • Grant the frontend team the logging.viewAccessor IAM role on this specific view. Correct Answer

Key Takeaways

The question tests enforced, IAM-enforced log filtering versus advisory filtering — the trap is choosing query sharing or developer instructions, which cannot restrict what a user actually reads once they have broader role grants.

This ACE scenario tests how to grant least-privilege, filtered access to aggregated logs in a centralized Google Cloud Logging project. The correct approach uses a log view scoped with an inclusion filter (all frontend logs plus only ERROR-level backend logs) and grants the frontend team the logging.viewAccessor IAM role on that specific view.

Common mistake: Option C is the most tempting wrong answer: granting logging.viewer on both projects and merely instructing developers to apply a filter. This violates least privilege because the filter is optional — the team could remove it and read everything, including non-error backend logs.

Expert Analysis

Why the Answer Is Correct

Option D uses Cloud Logging log views, the purpose-built mechanism for granting filtered access to logs in a bucket or log range. A log view applies a server-side inclusion filter — here, all logs from the frontend project plus only logs with severity ERROR from the backend project — so the restriction is enforced by IAM, not by user discipline. Granting logging.viewAccessor (View Accessor) on that specific view lets the frontend team read only what the view exposes, exactly satisfying least privilege. Because the logs stay in the existing aggregation bucket rather than being duplicated to a new destination, the solution is also cost-efficient, avoiding extra storage and ingestion of duplicated log data.

Why the Other Options Are Wrong

Option A merely saves and shares a Logs Explorer query and asks the team "not to use any other query" — a shared query is advisory, not enforced; anyone with broader viewer access could run any other query. Option B creates two additional log sinks routing data to a new Cloud Storage bucket, which duplicates log storage, increases cost, and complicates the pipeline; also, plain bucket read access does not give structured Logs Explorer querying the way log views do. Option C grants logging.viewer on the entire backend project, which is broader than needed and relies on developers voluntarily applying a filter, breaking least privilege.

Community Comment Notes

The single community comment agrees with this analysis, stating simply "answer=D" and reiterating the log view plus logging.viewAccessor approach. No one defended the query-sharing or instruction-based options, reflecting broad recognition that only a log view enforces the filter at the IAM layer.

Official Reference

https://cloud.google.com/logging/docs/access-control

This link opens the official vendor documentation in a new tab.

Exam Strategy

When a question demands least-privilege access to a subset of aggregated logs, look for a log view with a scoped inclusion filter plus logging.viewAccessor — anything relying on users following instructions or shared queries is not enforced and is therefore wrong.

Frequently Asked Questions

Why is sharing a Logs Explorer query not a valid access-control method?

A shared query only filters what a user chooses to run; anyone with broader logging.viewer access can simply change or clear the query and read logs the team should not see.

Why is logging.viewAccessor used instead of logging.viewer here?

logging.viewAccessor grants read access only to logs exposed by the specific log view, while logging.viewer grants read access to all logs in the project or scope, which violates least privilege.

More ACE FAQ →

Discussion 1 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 1

Mr_MIXER007 👍 1 Answered D

D. • In the centralized logging project, create a log view on the bucket that contains the aggregated logs. • Filter the view to include all logs from the frontend project and only logs with a severity level of ERROR from the backend project. • Grant the frontend team the logging.viewAccessor IAM role on this specific view.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All ACE Questions

Access 84 questions with complete answers and detailed explanations.

View Full ACE Practice Test →

← Back to ACE Study Guide