Granting Log Export Permissions in Google Cloud

PCDOE By islever Editorial Last updated

Managing and analyzing logs.

Short answer

A Grant the team members the IAM role of logging.configWriter on Cloud IAM.

Question

You manage an application that is writing logs to Stackdriver Logging. You need to give some team members the ability to export logs. What should you do?
  1. Grant the team members the IAM role of logging.configWriter on Cloud IAM. Correct Answer
  2. Configure Access Context Manager to allow only these members to export logs.
  3. Create and grant a custom IAM role with the permissions logging.sinks.list and logging.sink.get.
  4. Create an Organizational Policy in Cloud IAM to allow only these members to create log exports.

Key Takeaways

The core trap is confusing 'exporting' (creating a sink) with 'reading' logs; only the configWriter role provides the necessary write access to create sinks without granting broader read/write log permissions.

To enable users to export logs via sinks, you must grant the logging.configWriter IAM role. This question tests the specific permissions required for managing log sinks versus general log access.

Common mistake: Learners often choose Option C (custom role with list/get), but these are read-only permissions that do not allow creating or modifying sinks, which is required for exporting.

Expert Analysis

Why the Answer Is Correct

Correct answer: A — Grant the team members the IAM role of logging.configWriter on Cloud IAM. The logging.configWriter role (roles/logging.configWriter) explicitly grants permissions to manage log-based metrics and sinks. Since exporting logs in Google Cloud involves creating and configuring sinks, this role provides the necessary permissions to perform that action. It allows users to create, update, and delete sinks, which is the mechanism for exporting logs.

Why the Other Options Are Wrong

Option B (Access Context Manager) is used for network-level access control based on device state and user attributes, not for granular API permissions like log export. Option C suggests using logging.sinks.list and logging.sink.get, which are read-only permissions; they allow viewing existing sinks but do not permit creating new ones. Option D (Organizational Policy) is used to constrain organization-wide configurations, not to grant individual user permissions for specific actions.

Community Comment Notes

Community consensus strongly favors Option A. As noted by user rinkeshgala1, the logging.configWriter role is the standard way to handle this. User Goram113 correctly points out that C is wrong because it lacks the create permission. User Manh emphasizes that while C follows least privilege for reading, it fails to provide the actual ability to export (create) logs. User irocketsoldier highlights the distinction between needing to export vs just read, confirming A is the correct choice for export functionality.

Official Reference

https://cloud.google.com/logging/docs/access-control#logging.config_writer

This link opens the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between read-only permissions (list, get) and write/create permissions when questions involve 'exporting', 'creating', or 'configuring'. For log exports, remember that sinks are resources that must be created, requiring write access to the sink configuration.

Frequently Asked Questions

Why isn't a custom role with logging.sinks.create sufficient?

While logging.sinks.create is needed, the configWriter role includes it plus other necessary permissions for managing sinks and metrics, making it the complete solution.

Can I use logging.viewer role to export logs?

No, logging.viewer only allows reading logs. Exporting requires creating sinks, which needs configWriter permissions.

More PCDOE FAQ →

Discussion 22 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 22

  1. Goram113 👍 11
    logging.sinks.create is needed to export logs - this is why C is wrong
  2. Manh 👍 8
    It's should be C. least privilege The question is ask about export log and does not mention about read and write log Option A give too many permission Logs Configuration Writer (roles/logging.configWriter) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. logging.buckets.create logging.buckets.delete logging.buckets.get logging.buckets.list logging.buckets.undelete logging.buckets.update logging.cmekSettings. logging.exclusions. logging.locations. logging.logMetrics. logging.logServiceIndexes. logging.logServices. logging.logs.list logging.notificationRules. logging.operations. logging.sinks.* logging.views.create logging.views.delete logging.views.get logging.views.list logging.views.update resourcemanager.projects.get resourcemanager.projects.list
  3. irocketsoldier 👍 6
    I understand that option A gives the ability to export logs, but isn't C the best option following the least privilege principle since the question only says that the team members needs to export logs and not to write them?
  4. akg001 👍 5
    agree for the A.
  5. not_thanos 👍 4
    Write answer is A as stated in the documentation here https://cloud.google.com/logging/docs/export/configure_export_v2#before-you-begin "Note that this guide describes creating and managing sinks at the Cloud project level, but you can create sinks (non-aggregated) for billing accounts, folders, and organizations. As you get started, ensure the following: You have a Google Cloud project with logs that you can see in the Logs Explorer. You have one of the following IAM roles for the source Cloud project from which you're routing logs. Owner (roles/owner) Logging Admin (roles/logging.admin) Logs Configuration Writer (roles/logging.configWriter) The permissions contained in these roles allow you to create, delete, or modify sinks. For information on setting IAM roles, see the Logging Access control guide."
Show 17 more comments
  1. sticky 👍 4
    A is correct Logs Configuration Writer (roles/logging.configWriter) - Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs. https://cloud.google.com/logging/docs/access-control
  2. cloudbee 👍 3
    https://cloud.google.com/logging/docs/export/configure_export_v2#before-you-begin A is the answer
  3. giammydell 👍 3
    but C could follow the least privilege priciple
  4. Sreedharveluru 👍 3 Answered A
    There is no such thing called logging.sink.get
  5. Manh 👍 2
    After review again, Ans A had enough permission to export log https://cloud.google.com/logging/docs/routing/overview
  6. BlackCoffee 👍 1 Answered A
    Not C Custom roles can be used, but the permissions logging.sinks.list and logging.sink.get only allow team members to view existing sinks, not create or modify them to set up a new export. To create exports, permissions like logging.sinks.create are required.
  7. Epic_rose 👍 1 Answered A
    roles/logging.configWriter (Logs Configuration Writer) gives you the permissions to create log-based metrics, exclusions, buckets, and views, and to use sinks. To use the Logs Explorer (console) for these actions, add roles/logging.viewer.
  8. zygomar 👍 1 Answered A
    in addition to other comments here, C would be too restrictive. User new to have logs list permissions at least to know which logs to export. Goram113 also indicate that logging.sinks.create is needed to export logs hence why C is wrong
  9. hanweiCN 👍 1
    ability to use sinks Add logging.sinks.{list, create, get, update, delete} , the list, get function can only have view permission. can not create sinks to export logs. u need create sink to export logs.
  10. Trony 👍 1
    I agree. logging.configWriter (answer A) gives too much power to the team members. We only need to give them the rights to export, not change the whole logging configuration. C is ok.
  11. GaneshSurwase 👍 1
    correct ans is A Logs Configuration Writer (roles/logging.configWriter) Provides permissions to read and write the configurations of logs-based metrics and sinks for exporting logs.
  12. Shasha1 👍 1
    A Logs configuration writer can access to configure log exporting and metrics
  13. PhilipKoku 👍 1 Answered C
    C - Use principle of minimum access required to fulfill the requirements
  14. ric79 👍 1
    What is the minimum set of privs in order to export logs?
  15. vijaigcp 👍 1 Answered A
    Agree with A
  16. kleranti 👍 1 Answered C
    option c
  17. Ananda 👍 1 Answered A
    Option A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Binary Authorization Attestor Implementation

S-grade

GKE Cluster and Namespace Design for Data Isolation

S-grade

Optimizing SLO Balance Between Reliability and Velocity

S-grade

Minimizing GKE Logging Costs with SYSTEM Mode

S-grade

Practice All PCDOE Questions

Access 75 questions with complete answers and detailed explanations.

View Full PCDOE Practice Test →

← Back to PCDOE Study Guide