solutions/experimentation/core-landing-zone/lz-folder/audits/logging-project/project-iam.yaml [61:95]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              namespace: logging
---
# Logs Bucket writer IAM permissions for the platform and component log sink
# Binds the generated writer identity from the LoggingLogSink to the logging project
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions
  namespace: projects
  annotations:
    config.kubernetes.io/depends-on: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id} # kpt-set: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id}
spec:
  resourceRef:
    kind: Project
    name: logging-project-id # kpt-set: ${logging-project-id}
    namespace: projects
  bindings:
    - role: roles/logging.bucketWriter
      members:
        - memberFrom:
            logSinkRef:
              name: mgmt-project-cluster-platform-and-component-log-sink
              namespace: logging
---
# Enable data access log configuration on the logging project
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMAuditConfig
metadata:
  name: logging-project-data-access-log-config
  namespace: projects
  annotations:
    config.kubernetes.io/depends-on: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id} # kpt-set: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id}
spec:
  service: allServices
  auditLogConfigs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



solutions/legacy/logging/core-env/project-iam.yaml [84:119]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
              namespace: logging
---
# Logs Bucket writer IAM permissions for the platform and component log sink
# Binds the generated writer identity from the LoggingLogSink to the logging project
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMPartialPolicy
metadata:
  name: mgmt-project-cluster-platform-and-component-log-bucket-writer-permissions
  namespace: projects
  annotations:
    config.kubernetes.io/depends-on: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id} # kpt-set: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id}
spec:
  resourceRef:
    kind: Project
    name: logging-project-id # kpt-set: ${logging-project-id}
    namespace: projects
  # AC-3(7)
  bindings:
    - role: roles/logging.bucketWriter
      members:
        - memberFrom:
            logSinkRef:
              name: mgmt-project-cluster-platform-and-component-log-sink
              namespace: logging
---
# Enable data access log configuration on the logging project
apiVersion: iam.cnrm.cloud.google.com/v1beta1
kind: IAMAuditConfig
metadata:
  name: logging-project-data-access-log-config
  namespace: projects
  annotations:
    config.kubernetes.io/depends-on: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id} # kpt-set: resourcemanager.cnrm.cloud.google.com/namespaces/projects/Project/${logging-project-id}
spec:
  service: allServices
  auditLogConfigs:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



