You need to configure IAM access audit logging in BigQuery for external auditors. You want to follow Google-recommended practices. What should you do?

Google Cloud's Identity and Access Management (IAM) best practices strongly recommend using Google Groups to manage permissions for multiple users. This approach simplifies administration, as membership changes are managed within the group without altering IAM policies. For the task of auditing, the predefined roles roles/logging.viewer and roles/bigquery.dataViewer provide the necessary read-only permissions. The logging.viewer role allows viewing of audit logs, and the bigquery.dataViewer role allows viewing data within BigQuery tables. This combination grants sufficient access for an auditor while adhering to the principle of least privilege, avoiding the creation of unnecessary custom roles.

B. Creating custom IAM roles is not the recommended practice when suitable predefined roles already exist. It adds unnecessary management overhead.
C. Assigning IAM roles directly to individual user accounts is not scalable and is against Google-recommended practices for managing groups of users.
D. This option combines two non-recommended practices: assigning roles to individual users and creating custom roles when appropriate predefined roles are available.

1. Google Cloud Documentation

IAM Best Practices: "Use Google Groups to manage principals... We recommend that you use Google Groups to grant and change access controls for a group of users at once

instead of granting access controls to individual users." (Source: Google Cloud

"Best practices for using IAM"

Section: "Use Google Groups to manage principals").

2. Google Cloud Documentation

Cloud Logging Access Control: The roles/logging.viewer (Logs Viewer) role is described as providing permissions to view logs. This is the appropriate predefined role for an auditor needing to review audit logs. (Source: Google Cloud

"Access control with IAM"

Section: "Logging roles").

3. Google Cloud Documentation

BigQuery Access Control: The roles/bigquery.dataViewer (BigQuery Data Viewer) role grants permissions to view tables and their data. This is suitable for an auditor who needs to inspect the data being audited. (Source: Google Cloud

"Introduction to IAM in BigQuery"

Section: "Predefined roles and permissions").

4. Google Cloud Documentation

IAM Overview: "When possible

grant predefined roles instead of custom roles. Predefined roles are maintained by Google and are automatically updated as new permissions are added to Google Cloud." This supports the choice of predefined roles over custom ones. (Source: Google Cloud

"Understanding roles"

Section: "Role types").