You are building and running client applications in Cloud Run and Cloud Functions. Your client requires that all logs must be available for one year so that the client can import the logs into their l

Falco or Twistlock on GKE are runtime security tools for Kubernetes, not directly applicable to log retention and import requirements for Cloud Run and Cloud Functions, nor do they minimize code changes related to log management.

Configuring IAM policies primarily controls who can access resources, not how logs are retained or imported over a long period, nor does it address the technical mechanism for log data itself.

Binary Authorization enforces policies to ensure only trusted, signed container images are deployed, which is a foundational aspect of security and auditability. While seemingly indirect, ensuring the integrity and trustworthiness of the applications generating the logs (from Cloud Run and Cloud Functions) is critical for a client that needs to retain and import logs for a year, as it assures the provenance and reliability of the data source. This is a platform feature requiring minimal changes to application code itself.

Container Analysis in Artifact Registry scans for vulnerabilities in stored images, which is a security step for artifacts, but it does not directly manage the retention, availability, or import of application logs from running services for a year.