Exam Professional Cloud DevOps Engineer topic 1 question 140 discussion

Choose option A Grant the logging.logWriter and monitoring.metricWriter roles to the Compute Engine service accounts. These roles provide the necessary permissions for writing logs and metrics to Cloud Logging and Cloud Monitoring, respectively, without granting overly broad access. This aligns with the principle of least privilege, ensuring that the Compute Engine service accounts have the specific permissions needed for monitoring tasks without unnecessary additional privileges. This approach enables effective visibility for both operations and cyber security teams while maintaining a secure and well-defined access model.

Logs Writer (roles/logging.logWriter): Provides the permissions to write log entries. Monitoring Metric Writer (roles/monitoring.metricWriter): Provides write-only access to metrics. This provides exactly the permissions needed by the Cloud Monitoring agent and other systems that send metrics.

Remove admin role from the options and there is no such role as logging.editor, so it is A

Answer A seems to be correct as the two "writer" roles are least privilege granted to the service account.