This document describes how to manage the log entries generated by the resources contained in your Google Cloud organization by using a non-intercepting aggregated sink.
You can configure an aggregated sink to be intercepting or non-intercepting, depending on whether you want control over which log entries can be queried in, or routed through the sinks in child resources. In this tutorial, you create an aggregated sink that routes your organization's audit logs to a Google Cloud project, which then routes the aggregated audit logs to a log bucket. For more information, see Aggregated sinks overview.
In this tutorial, you perform the following steps:
You start by creating a log bucket and a log sink in the Google Cloud project where you want to store your aggregated log entries.
Next, you create a non-intercepting aggregated sink at the organization level to route log entries to the Google Cloud project that contains the log bucket.
You then configure read access to log views on the new log bucket.
Lastly, you query and view your log entries from the Logs Explorer page.
Before you begin
Ensure the following:
-
To get the permissions that you need to configure an aggregated sink, ask your administrator to grant you the following IAM roles on your organization:
-
To create log buckets and sinks in a project:
Logs Configuration Writer (
roles/logging.configWriter) - your project -
To create an aggregated sink:
Logs Configuration Writer (
roles/logging.configWriter) - your organization -
To grant roles to principals:
Owner (
roles/owner) - your project
For more information about granting roles, see Manage access to projects, folders, and organizations.
You might also be able to get the required permissions through custom roles or other predefined roles.
-
To create log buckets and sinks in a project:
Logs Configuration Writer (
- If you use VPC Service Controls, then you must add an ingress rule to the service perimeter. For more information about VPC Service Controls limitations, see Limitations.