Skip to main content

GCP Logging Bucket

A GCP Logging Bucket is a regional or multi-regional container managed by Cloud Logging that stores log entries collected by the Log Router. It defines how long logs are retained, which region they reside in, and the encryption method used. Logging buckets are distinct from Cloud Storage buckets and are only accessible through the Cloud Logging API. For full details, see the official documentation: https://cloud.google.com/logging/docs/storage.

Supported Methods​

  • GET: Get a gcp-logging-bucket by its "locations|buckets"
  • LIST
  • SEARCH: Search for gcp-logging-bucket by its "locations"

gcp-cloud-kms-crypto-key​

A logging bucket can be customer-managed encrypted (CMEK) with a Cloud KMS crypto key. The bucket’s configuration stores the full resource name of the key it uses, and Cloud Logging must be granted the appropriate cloudkms.cryptoKeyEncrypterDecrypter role on that key.

gcp-iam-service-account​

Access to read from, write to, or administer a logging bucket is granted through IAM policies that reference service accounts. The Log Router itself uses Google-managed service accounts, while user-created service accounts may be given roles such as logging.admin or logging.viewer on the bucket.