Google ACE Practice Question: Allow a Cloud Function to write logs to Cloud…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  roles/logging.logWriter

  Why this is correct

  roles/logging.logWriter is the predefined IAM role that contains the logging.logEntries.create permission, which is exactly what a Cloud Function needs to write log entries to Cloud Logging. Unlike broader roles, it does not include permissions to delete logs, manage log sinks, or modify log-based metrics, making it the least-privilege choice. Assigning this role to the function’s runtime service account allows both the Cloud Logging API and client libraries to write structured log entries on the function’s behalf.

• ✗

  roles/cloudfunctions.serviceAgent

  Why it's wrong here

  roles/cloudfunctions.serviceAgent is a Google-managed role automatically granted to the Cloud Functions service agent, a separate project-level identity (e.g., service-PROJECT_NUMBER@gcf-admin.iam.gserviceaccount.com) used by the Cloud Functions control plane to create and manage function infrastructure. This role does not provide permissions for the function’s own code to write logs; it is an internal service identity role and is not intended to be attached to the function’s runtime service account. The runtime service account needs the logging.logEntries.create permission, which this role does not contain.

• ✗

  roles/logging.admin

  Why it's wrong here

  roles/logging.admin grants all Logging permissions, including logging.logEntries.create (write), logging.logEntries.delete, and administrative operations like creating and deleting log buckets, sinks, and views. If assigned to a Cloud Function’s service account, it would allow the function to delete log entries or alter logging configurations, which is far more privilege than required for simply writing logs. Using logWriter instead adheres to the principle of least privilege by restricting the function to only the write operation, while admin is appropriate only for users who manage the project’s logging infrastructure.

• ✗

  roles/logging.viewer

  Why it's wrong here

  roles/logging.viewer is a read-only role that grants permissions such as logging.logEntries.get and logging.logEntries.list, allowing a principal to view and read log entries but not to create them. It contains no logging.logEntries.create permission, so a Cloud Function assigned this role would be unable to write any log output. This role is useful for analysts or auditors who need to examine logs, but it is completely insufficient for a function that must generate logs.

Go deeper

Related to this question