如何授权GCP服务账户写入指定Cloud Logging日志流

需求背景 #

需要授权GCP服务账户仅向指定的Cloud Logging日志流提交日志，避免直接授予roles/logging.logWriter角色导致该账户可写入其他日志流的权限过大问题。

目标日志流标识 #

resource.type="global"
log_name="projects/my-dev-project/logs/my-service"

现有Terraform配置 #

resource "google_service_account" "service_account" {
  account_id   = "my-service"
}

resource "google_project_iam_member" "log_writer" {
  project = "my-dev-project"
  role    = "roles/logging.logWriter"
  member  = google_service_account.service_account.member

  condition {
    title       = "Allow write to specific log"
    expression  = "????" # 需要替换为正确表达式
    # 目标：仅允许写入log_name="projects/my-dev-project/logs/my-service"
  }
}

尝试过的无效表达式 #

expression = "resource.log_name == \"projects/my-dev-project/logs/my-service\""

正确的条件表达式 #

问题出在字段名使用错误，GCP IAM条件中，日志流的完整名称对应的资源属性是resource.name，而非resource.log_name。正确的表达式写法如下：

expression = "resource.name == \"projects/my-dev-project/logs/my-service\""

补充说明 #

如果需要更灵活的匹配（比如匹配特定前缀的日志流），可以使用startsWith函数：

expression = "startsWith(resource.name, \"projects/my-dev-project/logs/my-service-\")"

内容的提问来源于stack exchange，提问作者Yasuhiro TATSUNO