Your organization stores all application logs from multiple Google Cloud projects in a central Cloud Logging project. Your security team wants to enforce a rule that each project team can only view th

Granting each project team access to the project _Default view in the central logging project would give all teams access to all logs in that view, violating the requirement that each team can only view their respective logs.

Creating IAM roles without specific log views would be too broad; IAM roles typically apply at the project or bucket level, not at the granular log entry level required to differentiate project-specific logs for different teams.

Cloud Logging log views allow you to define specific filters on log buckets, granting different teams access to only a subset of logs without duplicating data. This approach is cost-effective as it leverages existing log storage and access controls, fulfilling the least privilege requirement by showing each project team only their respective logs, while the operations team can be granted broader access to the entire log bucket.

Exporting logs to separate BigQuery tables for each project team would incur additional BigQuery storage and potentially export costs, and does not directly leverage Cloud Logging's built-in access control for views, thus not minimizing costs.