[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6990KV7FVWY802291TP6X7Y":3,"skill-same:01M6990KV7FVWY802291TP6X7Y":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":38,"linkOnly":39,"markdownContent":40,"markdownBody":41,"frontMatter":42,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":49,"repositoryHtmlUrl":50,"repositoryHomepageUrl":6,"ownerHtmlUrl":51,"ownerBlogUrl":52,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6990KV7FVWY802291TP6X7Y","cloud-logging-cross-project-configuration",null,"Configure and troubleshoot Google Cloud cross-project centralized logging and read-time aggregation. Use when: - Setting up log routing from multiple projects\u002Ffolders\u002Forganizations to a central log bucket. - Creating cross-project log sinks and configuring central log buckets. - Troubleshooting cross-project routing. Don't use for single-project basic configurations.","google\u002Fskills","google","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1342004?v=4","01M698VYEFDM0VJBZDYYJ2T83S","Google","01M698WR0H76ENHE587T9EJT89",24122,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-logging-cross-project-configuration\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,9,32,33,34,35,36,37],"cloud logging cross project configuration","logging","cloud","project","configuration","up","when","single","for","organizations","basic","time","log","use","read","projects","configure","troubleshoot","google cloud","2026-11-10 10:12:30",false,"---\nname: cloud-logging-cross-project-configuration\ndescription: >-\n  Configure and troubleshoot Google Cloud cross-project centralized logging and read-time aggregation.\n  Use when:\n  - Setting up log routing from multiple projects\u002Ffolders\u002Forganizations to a central log bucket.\n  - Creating cross-project log sinks and configuring central log buckets.\n  - Troubleshooting cross-project routing.\n  Don't use for single-project basic configurations.\nmetadata:\n  version: \"1.0.2\"\n  category: CloudObservabilityAndMonitoring\n---\n\n# Configuring Cross-Project Logging\n\nThis skill describes how to use `gcloud` commands to configure Cloud Logging so\nthat you store log data in a central location, regardless of the point of\norigin. The skill also describes how to query log data when that data is stored\nin multiple projects.\n\n> [!IMPORTANT] **Sandbox Network Limitation (CRITICAL for Agent Testing):**\n> During evaluation or in restricted sandboxed environments, network traffic to\n> GCP APIs is blocked. Do **NOT** run network discovery commands to find\n> resource names, project IDs, or organization IDs. Always use the exact project\n> IDs or placeholders provided in the user prompt or instructions, for example,\n> `{project_id}`, `{source_project_id}`, `{central_project_id}`. Assume these\n> resources exist and proceed directly with configuration commands. Running\n> these discovery commands will cause the execution to hang and timeout.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-logging-cross-project-configuration)\"`\nand append `agent-skills\u002F1.0 (skill:cloud-logging-cross-project-configuration)` to `User-Agent` headers.\n\n## Safety and Confirmation Tiers (CRITICAL)\n\nBefore executing any commands on behalf of the user, you MUST adhere to the\nfollowing safety tiers based on the action requested:\n\n1.  **Tier R: Read-Only**\n    *   **Description:** Commands that only read state or query logs.\n    *   **Example commands:**\n        *   `gcloud logging read`\n        *   `gcloud logging buckets list`\n    *   **Rule:** No confirmation needed. You may execute these commands\n        immediately to gather information.\n2.  **Tier M: Mutation (Non-Billing)**\n    *   **Description:** Configuration modifications or free metadata creations\n        that do not incur direct storage or billing costs and do not affect\n        resource security\u002Faccess policies.\n    *   **Example commands:**\n        *   `gcloud logging views create`\n        *   `gcloud logging views update`\n        *   `gcloud logging scopes create`\n        *   `gcloud logging buckets create`\n    *   **Rule:** No confirmation needed. You may execute these commands\n        immediately to apply configurations.\n3.  **Tier B: Billing and Security-Sensitive Mutations (High-Risk)**\n    *   **Description:** Operations that create billing-inducing resources or\n        integrations, or modify security and IAM access control policies\n        (presenting a risk of privilege escalation).\n    *   **Example commands:**\n        *   `gcloud logging metrics create`\n        *   `gcloud logging links create`\n        *   `gcloud projects add-iam-policy-binding`\n    *   **Rule:** **Interactive confirmation required.** These commands create\n        resources that incur billing costs or alter security access. You MUST\n        present the exact, literal command and receive user confirmation before\n        executing. NEVER execute in the same turn as asking.\n4.  **Tier D: Causes irreversible data loss**\n    *   **Description:** Actions that permanently discard or delete logs, for\n        example sink exclusions.\n    *   **Example commands:**\n        *   `gcloud logging buckets delete`\n        *   `gcloud logging sinks update --add-exclusion`\n    *   **Rule:** **Explicit typed confirmation required.** These commands\n        discard or delete logs immediately and irreversibly, or they may result\n        in log data not being stored. You MUST ask for explicit typed\n        confirmation, for example, \"Yes, discard logs\", and halt execution until\n        the user replies.\n\n## Decision Matrix: Centralized Storage vs. Distributed Storage with Read-Time Aggregation\n\nUse this decision matrix to evaluate and choose between **Centralized Storage**\nand **Read-Time Aggregation**. With centralized storage, log data is routed to\none log bucket, regardless of where the data originates. You write queries\nagainst the centralized log bucket. With read-time aggregation, log data is\nstored by the resource where it originates. However, a single query aggregates\nthe data by querying all resources.\n\nAfter you have determined the optimal architecture for handling cross-project\nlogs, follow the corresponding configuration steps detailed below.\n\n| Criterion             | Centralized Storage      | Read-Time Aggregation    |\n| :-------------------- | :----------------------- | :----------------------- |\n| **GCP Project Scale** | Scales to thousands of   | Best for \u003C 375 projects. |\n:                       : projects.                :                          :\n| **Log Storage**       | Consolidated in a single | Resides in originating   |\n:                       : log bucket.              : resources.               :\n| **SQL Analytics**     | Easy; unified querying   | Hard; requires querying  |\n:                       : via Observability        : multiple log buckets.    :\n:                       : Analytics.               :                          :\n| **Access Control**    | Scoped access via log    | Requires IAM access to   |\n:                       : views on the centralized : all views on resources   :\n:                       : log bucket.              : that store log data.     :\n| **Configuration**     | Options vary based on    | Will not interfere with  |\n: **Complexity**        : Project, Folder,         : bucket-based log-based   :\n:                       : Organization structure.  : metrics.                 :\n| **Cost**              | Potential for duplicate  | Cost-effective; no data  |\n:                       : storage of log buckets   : replication.             :\n:                       : if exclusions aren't     :                          :\n:                       : set.                     :                          :\n\n## Architecture\n\n### Centralized Storage (Log Routing)\n\n```mermaid\ngraph LR\n    subgraph \"Source Project(s)\"\n        Log[Resource Logs] --> Sink[\"Sink: route-to-central-project\"]\n    end\n\n    subgraph \"Central Project\"\n        Sink --> Bucket[\"Bucket: central-logs-bucket (us-central1)\"]\n    end\n```\n\n### Read-Time Aggregation (Log Scopes)\n\n```mermaid\ngraph LR\n    subgraph \"Source Project 1\"\n        Log1[Resource Logs] --> Bucket1[\"Bucket: _Default\"]\n    end\n\n    subgraph \"Source Project 2\"\n        Log2[Resource Logs] --> Bucket2[\"Bucket: _Default\"]\n    end\n\n    subgraph \"Scoping Project (No Log Storage)\"\n        Scope[\"Log scope: central-query-scope\"]\n        Scope -.-> View1[\"_AllLogs View on Bucket1\"]\n        Scope -.-> View2[\"_AllLogs View on Bucket2\"]\n    end\n```\n\n## Setup Steps: Centralized Storage (Log Routing)\n\nUse these steps to route logs from one or more source projects to a central log\nbucket in a project. Create or select the Google Cloud project that you will use\nfor storing your log data. This is the central project.\n\n### 1. Create log bucket in central project (Tier M)\n\nCreate a custom log bucket with Log Analytics enabled.\n\n> [Tip] Use regional log buckets, for example, set the location to\n> `us-central1`. Don't use the `global` location. This approach ensures\n> compatibility with Observability Analytics and SQL querying.\n\n```bash\ngcloud logging buckets create {bucket_id} \\\n    --project={central_project_id} \\\n    --location={region} \\\n    --retention-days={retention_days} \\\n    --enable-analytics\n```\n\n### 2. Create log sink in central project (Tier M)\n\nCreate a project-level sink in the central project pointing to the central log\nbucket. This sink routes logs that land in the central project's Log Router into\nthe central log bucket.\n\nAssuming the newly created bucket is specifically for centralizing data from\nother projects (and the central project is not one of the source projects), the\ncentral sink should exclude the central project's own logs. Include the\n`_Required` audit log exclusions on this central sink to avoid redundancy\nbetween `{bucket_id}` and the `_Required` bucket.\n\n```bash\ngcloud logging sinks create {sink_name} \\\n    logging.googleapis.com\u002Fprojects\u002F{central_project_id}\u002Flocations\u002F{region}\u002Fbuckets\u002F{bucket_id} \\\n    --project={central_project_id} \\\n    --exclusion=filter='logName:\"projects\u002F{central_project_id}\u002F\"' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n```\n\n### 3. Create log sink in source resource (Tier M)\n\nTo route logs to the central project, you must create a log sink in each source\norganization, folder, or project. While you can configure a sink to route only a\nsubset of logs using the `--log-filter` argument, recommended practice is to\nroute all non-audit logs, and then restrict access or partition logs at the\ndestination using custom Log Views on the centralized log bucket.\n\n*   **For an organization-level log sink**\n\n    ```bash\n    gcloud logging sinks create {sink_name} \\\n        logging.googleapis.com\u002Fprojects\u002F{central_project_id} \\\n        --organization={source_organization_id} \\\n        --include-children \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n    ```\n\n*   **For project-level log sinks**\n\n    ```bash\n    gcloud logging sinks create {sink_name} \\\n        logging.googleapis.com\u002Fprojects\u002F{central_project_id} \\\n        --project={source_project_id} \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n    ```\n\n### 4. Grant IAM permissions to sink writers (Tier B)\n\n> [!IMPORTANT] **Security Action (Tier B):** Granting IAM permissions changes\n> access control policy and must be explicitly confirmed by the user before\n> execution.\n\nTo allow the source sinks to route logs to the central project's router, and to\nallow the central sink to write logs to the central bucket:\n\n1.  **Grant Logs Writer permission to the source sink:** Retrieve the\n    `writerIdentity` of the source log sink and grant it\n    `roles\u002Flogging.logWriter` on the central project.\n\n    ```bash\n    # Get the writer identity of the source sink\n    gcloud logging sinks describe {sink_name} \\\n        --project={source_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n    The output is the `{source_writer_identity}` value (for example\n    `serviceAccount:...`) for the following command:\n\n    ```bash\n    # Grant Logs Writer permissions on the central project\n    gcloud projects add-iam-policy-binding {central_project_id} \\\n        --member={source_writer_identity} \\\n        --role=roles\u002Flogging.logWriter\n    ```\n\n2.  **Grant Bucket Writer permission to the central sink:** Retrieve the\n    `writerIdentity` of the central log sink and grant it\n    `roles\u002Flogging.bucketWriter` on the central project.\n\n    ```bash\n    # Get the writer identity of the central sink\n    gcloud logging sinks describe {central_sink_name} \\\n        --project={central_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n    The output is the `{central_writer_identity}` value for the following\n    command:\n\n    ```bash\n    # Grant Bucket Writer permissions on the central project\n    gcloud projects add-iam-policy-binding {central_project_id} \\\n        --member={central_writer_identity} \\\n        --role=roles\u002Flogging.bucketWriter\n    ```\n\n### 5. Create custom Log Views on the central bucket (Tier M)\n\nTo partition logs or restrict access by log ID or project (since all logs were\nrouted to the same central bucket), create custom Log Views on the central\nbucket.\n\n*   **Filter by log ID:**\n\n    ```bash\n    gcloud logging views create {view_id} \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --project={central_project_id} \\\n        --log-filter='LOG_ID(\"{log_id}\")'\n    ```\n\n*   **Filter by source project:**\n\n    ```bash\n    gcloud logging views create {view_id} \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --project={central_project_id} \\\n        --log-filter='project_id=\"{source_project_id}\"'\n    ```\n\n### Verify Centralized Log Routing (Tier R)\n\nTo verify that logs are being routed from the source projects to the central\nregional log bucket:\n\n1.  **Write a test log in the source project:**\n\n    ```bash\n    gcloud logging write {test_log_id} \"Test log entry for verification\" \\\n        --severity=WARNING \\\n        --project={source_project_id}\n    ```\n\n2.  **Read the test log from the central log bucket:** For regional log buckets,\n    you **must** specify the `--view` flag. Because the default view `_Default`\n    only contains logs matching the default filter, you should query the\n    **`_AllLogs`** view or your custom log view on the central bucket:\n\n    ```bash\n    gcloud logging read 'logName:\"projects\u002F{source_project_id}\u002Flogs\u002F{test_log_id}\"' \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --view=_AllLogs \\\n        --project={central_project_id}\n    ```\n\n--------------------------------------------------------------------------------\n\n## Setup Steps: Read-Time Aggregation (Log Scopes)\n\nCreate or select a Google Cloud project that you will use for querying your log\ndata. This is the scoping project. Use these steps to configure a log scope. Log\nscopes let you issue a query for log data that is stored in multiple projects.\n\n### 1. Create a custom Log View (Optional but recommended) (Tier M)\n\nCreate a Log View in the source project to restrict which logs are accessible.\n\n> [!IMPORTANT] **Gotcha:** Log View filters can only contain specific\n> restrictions. Refer to\n> https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flogs-views.md.txt#view-filter\n\n```bash\ngcloud logging views create {view_id} \\\n    --bucket={bucket_id} \\\n    --location={region} \\\n    --project={source_project_id} \\\n    --log-filter='LOG_ID(\"{log_id}\")'\n```\n\n*   `{bucket_id}`: for example, `_Default`\n*   `{region}`: for example, `global`\n*   `{view_id}`: for example, `app-logs-view`\n*   If you want to allow access to all logs in the log bucket, omit the\n    `--log-filter` flag.\n\n### 2. Create a log scope in the scoping project (Tier M)\n\nCreate a log scope in the scoping project listing the source resources, which\nmay be projects or specific log views.\n\n```bash\ngcloud logging scopes create {log_scope_id} \\\n    --project={scoping_project_id} \\\n    --resource-names={resource_names}\n```\n\n*   `{log_scope_id}`: for example, `central-query-scope`\n*   `{resource_names}`: Comma-separated list of log views. For example,\n    `projects\u002Fsource-project-1\u002Flocations\u002Fglobal\u002Fbuckets\u002F_Default\u002Fviews\u002Fapp-logs-view,projects\u002Fsource-project-2\u002Flocations\u002Fglobal\u002Fbuckets\u002F_Default\u002Fviews\u002Fapp-logs-view`.\n    You can include up to 100 views in the scope.\n\n### 3. Update Default Observability Scope (Optional) (Tier M)\n\nLink the log scope to the project's default observability scope so it is used by\ndefault in Logs Explorer.\n\n```bash\ngcloud observability scopes update _Default \\\n    --project={scoping_project_id} \\\n    --location=global \\\n    --log-scope=\u002F\u002Flogging.googleapis.com\u002Fprojects\u002F{scoping_project_id}\u002Flocations\u002Fglobal\u002FlogScopes\u002F{log_scope_id}\n```\n\n### 4. Grant IAM permissions to users (Tier B)\n\nUnlike centralized routing, permissions are checked at query time on all source\nprojects. Users running queries must have:\n\n*   `roles\u002Flogging.viewAccessor` granted on the specific Log View (with IAM\n    conditions) or `roles\u002Flogging.viewer` on the source projects.\n*   Access to the scoping project.\n\n## Troubleshooting Cross-Project Log Routing and Sink Permission Failures\n\nIf logs are not appearing in a central project's bucket after configuring\ncentralized logging:\n\n### 1. Verify Log Router Sink Filters in Source Resource\n\n*   Ensure that the log sink's filter matches the logs you expect to route.\n\n    > [!IMPORTANT] **Gotcha:** Standard filter expressions like `logName:abc` or\n    > `logName=\"projects\u002F{project_id}\u002Flogs\u002Fabc\"` can fail to match in log sinks.\n    > **Always** use `LOG_ID(\"abc\")` for precise matching in log sink filters.\n\n*   Verify that you have not configured an exclusion filter that accidentally\n    discards these logs.\n\n### 2. Verify and Grant Writer Identity Permissions (Most Common Cause)\n\nThe log sink's writer identity service account in the source project must be\nexplicitly granted the necessary permissions on the central resource.\n\n*   **Step A: Get the Writer Identity**\n\n    ```bash\n    gcloud logging sinks describe {sink_name} \\\n        --project={source_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n*   **Step B: Grant the Permission in the Central Project (Tier B)**\n\n    > [!IMPORTANT] **Security Action (Tier B):** Granting IAM permissions\n    > changes access control policy and must be explicitly confirmed by the user\n    > before execution.\n\n    *   **For Cloud Logging Buckets (standard):** Grant\n        `roles\u002Flogging.bucketWriter`:\n\n        ```bash\n        gcloud projects add-iam-policy-binding {central_project_id} \\\n            --member={writer_identity} \\\n            --role=roles\u002Flogging.bucketWriter\n        ```\n\n    *   **For GCS Buckets:** Grant `roles\u002Fstorage.objectCreator` on the GCS\n        bucket.\n\n    *   **For Pub\u002FSub Topics:** Grant `roles\u002Fpubsub.publisher` on the Pub\u002FSub\n        topic.\n\n    *   **For BigQuery Datasets:** Grant `roles\u002Fbigquery.dataEditor` on the\n        BigQuery dataset.\n\n--------------------------------------------------------------------------------\n\n## References and Supporting Links\n\n*   [GCP Cloud Logging - Routing and Storage Overview](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Frouting\u002Foverview.md.txt)\n*   [GCP Cloud Logging - Log Scopes](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flog-scope\u002Fcreate-and-manage.md.txt)\n*   [GCP Cloud Logging - Custom Log Views](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flogs-views.md.txt)\n","# Configuring Cross-Project Logging\n\nThis skill describes how to use `gcloud` commands to configure Cloud Logging so\nthat you store log data in a central location, regardless of the point of\norigin. The skill also describes how to query log data when that data is stored\nin multiple projects.\n\n> [!IMPORTANT] **Sandbox Network Limitation (CRITICAL for Agent Testing):**\n> During evaluation or in restricted sandboxed environments, network traffic to\n> GCP APIs is blocked. Do **NOT** run network discovery commands to find\n> resource names, project IDs, or organization IDs. Always use the exact project\n> IDs or placeholders provided in the user prompt or instructions, for example,\n> `{project_id}`, `{source_project_id}`, `{central_project_id}`. Assume these\n> resources exist and proceed directly with configuration commands. Running\n> these discovery commands will cause the execution to hang and timeout.\n\n## Attribution\n\n**MUST READ**: Before executing any `gcloud`, REST API, or MCP command, you\nMUST read [Usage Attribution](references\u002Fattribution.md). For commands executed\ndirectly in the terminal (never in generated scripts, Terraform, or user code),\nprefix `gcloud` with\n`CLOUDSDK_METRICS_REQUEST_ATTRIBUTION=\"agent-skills\u002F1.0 (skill:cloud-logging-cross-project-configuration)\"`\nand append `agent-skills\u002F1.0 (skill:cloud-logging-cross-project-configuration)` to `User-Agent` headers.\n\n## Safety and Confirmation Tiers (CRITICAL)\n\nBefore executing any commands on behalf of the user, you MUST adhere to the\nfollowing safety tiers based on the action requested:\n\n1.  **Tier R: Read-Only**\n    *   **Description:** Commands that only read state or query logs.\n    *   **Example commands:**\n        *   `gcloud logging read`\n        *   `gcloud logging buckets list`\n    *   **Rule:** No confirmation needed. You may execute these commands\n        immediately to gather information.\n2.  **Tier M: Mutation (Non-Billing)**\n    *   **Description:** Configuration modifications or free metadata creations\n        that do not incur direct storage or billing costs and do not affect\n        resource security\u002Faccess policies.\n    *   **Example commands:**\n        *   `gcloud logging views create`\n        *   `gcloud logging views update`\n        *   `gcloud logging scopes create`\n        *   `gcloud logging buckets create`\n    *   **Rule:** No confirmation needed. You may execute these commands\n        immediately to apply configurations.\n3.  **Tier B: Billing and Security-Sensitive Mutations (High-Risk)**\n    *   **Description:** Operations that create billing-inducing resources or\n        integrations, or modify security and IAM access control policies\n        (presenting a risk of privilege escalation).\n    *   **Example commands:**\n        *   `gcloud logging metrics create`\n        *   `gcloud logging links create`\n        *   `gcloud projects add-iam-policy-binding`\n    *   **Rule:** **Interactive confirmation required.** These commands create\n        resources that incur billing costs or alter security access. You MUST\n        present the exact, literal command and receive user confirmation before\n        executing. NEVER execute in the same turn as asking.\n4.  **Tier D: Causes irreversible data loss**\n    *   **Description:** Actions that permanently discard or delete logs, for\n        example sink exclusions.\n    *   **Example commands:**\n        *   `gcloud logging buckets delete`\n        *   `gcloud logging sinks update --add-exclusion`\n    *   **Rule:** **Explicit typed confirmation required.** These commands\n        discard or delete logs immediately and irreversibly, or they may result\n        in log data not being stored. You MUST ask for explicit typed\n        confirmation, for example, \"Yes, discard logs\", and halt execution until\n        the user replies.\n\n## Decision Matrix: Centralized Storage vs. Distributed Storage with Read-Time Aggregation\n\nUse this decision matrix to evaluate and choose between **Centralized Storage**\nand **Read-Time Aggregation**. With centralized storage, log data is routed to\none log bucket, regardless of where the data originates. You write queries\nagainst the centralized log bucket. With read-time aggregation, log data is\nstored by the resource where it originates. However, a single query aggregates\nthe data by querying all resources.\n\nAfter you have determined the optimal architecture for handling cross-project\nlogs, follow the corresponding configuration steps detailed below.\n\n| Criterion             | Centralized Storage      | Read-Time Aggregation    |\n| :-------------------- | :----------------------- | :----------------------- |\n| **GCP Project Scale** | Scales to thousands of   | Best for \u003C 375 projects. |\n:                       : projects.                :                          :\n| **Log Storage**       | Consolidated in a single | Resides in originating   |\n:                       : log bucket.              : resources.               :\n| **SQL Analytics**     | Easy; unified querying   | Hard; requires querying  |\n:                       : via Observability        : multiple log buckets.    :\n:                       : Analytics.               :                          :\n| **Access Control**    | Scoped access via log    | Requires IAM access to   |\n:                       : views on the centralized : all views on resources   :\n:                       : log bucket.              : that store log data.     :\n| **Configuration**     | Options vary based on    | Will not interfere with  |\n: **Complexity**        : Project, Folder,         : bucket-based log-based   :\n:                       : Organization structure.  : metrics.                 :\n| **Cost**              | Potential for duplicate  | Cost-effective; no data  |\n:                       : storage of log buckets   : replication.             :\n:                       : if exclusions aren't     :                          :\n:                       : set.                     :                          :\n\n## Architecture\n\n### Centralized Storage (Log Routing)\n\n```mermaid\ngraph LR\n    subgraph \"Source Project(s)\"\n        Log[Resource Logs] --> Sink[\"Sink: route-to-central-project\"]\n    end\n\n    subgraph \"Central Project\"\n        Sink --> Bucket[\"Bucket: central-logs-bucket (us-central1)\"]\n    end\n```\n\n### Read-Time Aggregation (Log Scopes)\n\n```mermaid\ngraph LR\n    subgraph \"Source Project 1\"\n        Log1[Resource Logs] --> Bucket1[\"Bucket: _Default\"]\n    end\n\n    subgraph \"Source Project 2\"\n        Log2[Resource Logs] --> Bucket2[\"Bucket: _Default\"]\n    end\n\n    subgraph \"Scoping Project (No Log Storage)\"\n        Scope[\"Log scope: central-query-scope\"]\n        Scope -.-> View1[\"_AllLogs View on Bucket1\"]\n        Scope -.-> View2[\"_AllLogs View on Bucket2\"]\n    end\n```\n\n## Setup Steps: Centralized Storage (Log Routing)\n\nUse these steps to route logs from one or more source projects to a central log\nbucket in a project. Create or select the Google Cloud project that you will use\nfor storing your log data. This is the central project.\n\n### 1. Create log bucket in central project (Tier M)\n\nCreate a custom log bucket with Log Analytics enabled.\n\n> [Tip] Use regional log buckets, for example, set the location to\n> `us-central1`. Don't use the `global` location. This approach ensures\n> compatibility with Observability Analytics and SQL querying.\n\n```bash\ngcloud logging buckets create {bucket_id} \\\n    --project={central_project_id} \\\n    --location={region} \\\n    --retention-days={retention_days} \\\n    --enable-analytics\n```\n\n### 2. Create log sink in central project (Tier M)\n\nCreate a project-level sink in the central project pointing to the central log\nbucket. This sink routes logs that land in the central project's Log Router into\nthe central log bucket.\n\nAssuming the newly created bucket is specifically for centralizing data from\nother projects (and the central project is not one of the source projects), the\ncentral sink should exclude the central project's own logs. Include the\n`_Required` audit log exclusions on this central sink to avoid redundancy\nbetween `{bucket_id}` and the `_Required` bucket.\n\n```bash\ngcloud logging sinks create {sink_name} \\\n    logging.googleapis.com\u002Fprojects\u002F{central_project_id}\u002Flocations\u002F{region}\u002Fbuckets\u002F{bucket_id} \\\n    --project={central_project_id} \\\n    --exclusion=filter='logName:\"projects\u002F{central_project_id}\u002F\"' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n    --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n    --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n```\n\n### 3. Create log sink in source resource (Tier M)\n\nTo route logs to the central project, you must create a log sink in each source\norganization, folder, or project. While you can configure a sink to route only a\nsubset of logs using the `--log-filter` argument, recommended practice is to\nroute all non-audit logs, and then restrict access or partition logs at the\ndestination using custom Log Views on the centralized log bucket.\n\n*   **For an organization-level log sink**\n\n    ```bash\n    gcloud logging sinks create {sink_name} \\\n        logging.googleapis.com\u002Fprojects\u002F{central_project_id} \\\n        --organization={source_organization_id} \\\n        --include-children \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n    ```\n\n*   **For project-level log sinks**\n\n    ```bash\n    gcloud logging sinks create {sink_name} \\\n        logging.googleapis.com\u002Fprojects\u002F{central_project_id} \\\n        --project={source_project_id} \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Factivity\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Fsystem_event\")' \\\n        --exclusion=filter='LOG_ID(\"cloudaudit.googleapis.com\u002Faccess_transparency\")' \\\n        --exclusion=filter='LOG_ID(\"externalaudit.googleapis.com\u002Faccess_transparency\")'\n    ```\n\n### 4. Grant IAM permissions to sink writers (Tier B)\n\n> [!IMPORTANT] **Security Action (Tier B):** Granting IAM permissions changes\n> access control policy and must be explicitly confirmed by the user before\n> execution.\n\nTo allow the source sinks to route logs to the central project's router, and to\nallow the central sink to write logs to the central bucket:\n\n1.  **Grant Logs Writer permission to the source sink:** Retrieve the\n    `writerIdentity` of the source log sink and grant it\n    `roles\u002Flogging.logWriter` on the central project.\n\n    ```bash\n    # Get the writer identity of the source sink\n    gcloud logging sinks describe {sink_name} \\\n        --project={source_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n    The output is the `{source_writer_identity}` value (for example\n    `serviceAccount:...`) for the following command:\n\n    ```bash\n    # Grant Logs Writer permissions on the central project\n    gcloud projects add-iam-policy-binding {central_project_id} \\\n        --member={source_writer_identity} \\\n        --role=roles\u002Flogging.logWriter\n    ```\n\n2.  **Grant Bucket Writer permission to the central sink:** Retrieve the\n    `writerIdentity` of the central log sink and grant it\n    `roles\u002Flogging.bucketWriter` on the central project.\n\n    ```bash\n    # Get the writer identity of the central sink\n    gcloud logging sinks describe {central_sink_name} \\\n        --project={central_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n    The output is the `{central_writer_identity}` value for the following\n    command:\n\n    ```bash\n    # Grant Bucket Writer permissions on the central project\n    gcloud projects add-iam-policy-binding {central_project_id} \\\n        --member={central_writer_identity} \\\n        --role=roles\u002Flogging.bucketWriter\n    ```\n\n### 5. Create custom Log Views on the central bucket (Tier M)\n\nTo partition logs or restrict access by log ID or project (since all logs were\nrouted to the same central bucket), create custom Log Views on the central\nbucket.\n\n*   **Filter by log ID:**\n\n    ```bash\n    gcloud logging views create {view_id} \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --project={central_project_id} \\\n        --log-filter='LOG_ID(\"{log_id}\")'\n    ```\n\n*   **Filter by source project:**\n\n    ```bash\n    gcloud logging views create {view_id} \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --project={central_project_id} \\\n        --log-filter='project_id=\"{source_project_id}\"'\n    ```\n\n### Verify Centralized Log Routing (Tier R)\n\nTo verify that logs are being routed from the source projects to the central\nregional log bucket:\n\n1.  **Write a test log in the source project:**\n\n    ```bash\n    gcloud logging write {test_log_id} \"Test log entry for verification\" \\\n        --severity=WARNING \\\n        --project={source_project_id}\n    ```\n\n2.  **Read the test log from the central log bucket:** For regional log buckets,\n    you **must** specify the `--view` flag. Because the default view `_Default`\n    only contains logs matching the default filter, you should query the\n    **`_AllLogs`** view or your custom log view on the central bucket:\n\n    ```bash\n    gcloud logging read 'logName:\"projects\u002F{source_project_id}\u002Flogs\u002F{test_log_id}\"' \\\n        --bucket={bucket_id} \\\n        --location={region} \\\n        --view=_AllLogs \\\n        --project={central_project_id}\n    ```\n\n--------------------------------------------------------------------------------\n\n## Setup Steps: Read-Time Aggregation (Log Scopes)\n\nCreate or select a Google Cloud project that you will use for querying your log\ndata. This is the scoping project. Use these steps to configure a log scope. Log\nscopes let you issue a query for log data that is stored in multiple projects.\n\n### 1. Create a custom Log View (Optional but recommended) (Tier M)\n\nCreate a Log View in the source project to restrict which logs are accessible.\n\n> [!IMPORTANT] **Gotcha:** Log View filters can only contain specific\n> restrictions. Refer to\n> https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flogs-views.md.txt#view-filter\n\n```bash\ngcloud logging views create {view_id} \\\n    --bucket={bucket_id} \\\n    --location={region} \\\n    --project={source_project_id} \\\n    --log-filter='LOG_ID(\"{log_id}\")'\n```\n\n*   `{bucket_id}`: for example, `_Default`\n*   `{region}`: for example, `global`\n*   `{view_id}`: for example, `app-logs-view`\n*   If you want to allow access to all logs in the log bucket, omit the\n    `--log-filter` flag.\n\n### 2. Create a log scope in the scoping project (Tier M)\n\nCreate a log scope in the scoping project listing the source resources, which\nmay be projects or specific log views.\n\n```bash\ngcloud logging scopes create {log_scope_id} \\\n    --project={scoping_project_id} \\\n    --resource-names={resource_names}\n```\n\n*   `{log_scope_id}`: for example, `central-query-scope`\n*   `{resource_names}`: Comma-separated list of log views. For example,\n    `projects\u002Fsource-project-1\u002Flocations\u002Fglobal\u002Fbuckets\u002F_Default\u002Fviews\u002Fapp-logs-view,projects\u002Fsource-project-2\u002Flocations\u002Fglobal\u002Fbuckets\u002F_Default\u002Fviews\u002Fapp-logs-view`.\n    You can include up to 100 views in the scope.\n\n### 3. Update Default Observability Scope (Optional) (Tier M)\n\nLink the log scope to the project's default observability scope so it is used by\ndefault in Logs Explorer.\n\n```bash\ngcloud observability scopes update _Default \\\n    --project={scoping_project_id} \\\n    --location=global \\\n    --log-scope=\u002F\u002Flogging.googleapis.com\u002Fprojects\u002F{scoping_project_id}\u002Flocations\u002Fglobal\u002FlogScopes\u002F{log_scope_id}\n```\n\n### 4. Grant IAM permissions to users (Tier B)\n\nUnlike centralized routing, permissions are checked at query time on all source\nprojects. Users running queries must have:\n\n*   `roles\u002Flogging.viewAccessor` granted on the specific Log View (with IAM\n    conditions) or `roles\u002Flogging.viewer` on the source projects.\n*   Access to the scoping project.\n\n## Troubleshooting Cross-Project Log Routing and Sink Permission Failures\n\nIf logs are not appearing in a central project's bucket after configuring\ncentralized logging:\n\n### 1. Verify Log Router Sink Filters in Source Resource\n\n*   Ensure that the log sink's filter matches the logs you expect to route.\n\n    > [!IMPORTANT] **Gotcha:** Standard filter expressions like `logName:abc` or\n    > `logName=\"projects\u002F{project_id}\u002Flogs\u002Fabc\"` can fail to match in log sinks.\n    > **Always** use `LOG_ID(\"abc\")` for precise matching in log sink filters.\n\n*   Verify that you have not configured an exclusion filter that accidentally\n    discards these logs.\n\n### 2. Verify and Grant Writer Identity Permissions (Most Common Cause)\n\nThe log sink's writer identity service account in the source project must be\nexplicitly granted the necessary permissions on the central resource.\n\n*   **Step A: Get the Writer Identity**\n\n    ```bash\n    gcloud logging sinks describe {sink_name} \\\n        --project={source_project_id} \\\n        --format=\"value(writerIdentity)\"\n    ```\n\n*   **Step B: Grant the Permission in the Central Project (Tier B)**\n\n    > [!IMPORTANT] **Security Action (Tier B):** Granting IAM permissions\n    > changes access control policy and must be explicitly confirmed by the user\n    > before execution.\n\n    *   **For Cloud Logging Buckets (standard):** Grant\n        `roles\u002Flogging.bucketWriter`:\n\n        ```bash\n        gcloud projects add-iam-policy-binding {central_project_id} \\\n            --member={writer_identity} \\\n            --role=roles\u002Flogging.bucketWriter\n        ```\n\n    *   **For GCS Buckets:** Grant `roles\u002Fstorage.objectCreator` on the GCS\n        bucket.\n\n    *   **For Pub\u002FSub Topics:** Grant `roles\u002Fpubsub.publisher` on the Pub\u002FSub\n        topic.\n\n    *   **For BigQuery Datasets:** Grant `roles\u002Fbigquery.dataEditor` on the\n        BigQuery dataset.\n\n--------------------------------------------------------------------------------\n\n## References and Supporting Links\n\n*   [GCP Cloud Logging - Routing and Storage Overview](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Frouting\u002Foverview.md.txt)\n*   [GCP Cloud Logging - Log Scopes](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flog-scope\u002Fcreate-and-manage.md.txt)\n*   [GCP Cloud Logging - Custom Log Views](https:\u002F\u002Fdocs.cloud.google.com\u002Flogging\u002Fdocs\u002Flogs-views.md.txt)\n",{"name":5,"metadata":43,"description":7},{"version":44,"category":45},"1.0.2","CloudObservabilityAndMonitoring","main","bb9b3f464aae37af360d079c1d863524955b0363","skills\u002Fcloud\u002Fcloud-logging-cross-project-configuration",2005,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills","https:\u002F\u002Fgithub.com\u002Fgoogle","https:\u002F\u002Fopensource.google\u002F","Google ❤️ Open Source","2026-11-14 01:51:35",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add google\u002Fskills --skill cloud-logging-cross-project-configuration",{"tool":61,"command":62},"bunx","bunx skills add google\u002Fskills --skill cloud-logging-cross-project-configuration",{"tool":64,"command":65},"pnpm","pnpm dlx skills add google\u002Fskills --skill cloud-logging-cross-project-configuration","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-logging-cross-project-configuration\u002FSKILL.md",true,[69],{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"references\u002Fattribution.md","REFERENCE","参考文档",1963,"https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fcloud-logging-cross-project-configuration\u002Freferences\u002Fattribution.md",[76,113,144,173,200,223],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":90,"publishedAt":38},"01M6998S2EZKD3GEJ7F943RZTE","sign-in-with-google-web","Implement, configure, and secure Sign In With Google (SiwG) using Google Identity Services (GIS \u002F `https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fclient`) across web architectures. Use when creating Google sign-in buttons, implementing Google One Tap with FedCM, integrating GIS in React\u002FNext.js\u002FAngular\u002FHTML, verifying ID tokens on backend runtimes (Python\u002FNode.js\u002FGo\u002FJava), enforcing Google Workspace domain restrictions (`hd`), securing client-side ID tokens via WebCrypto nonces or encrypted IndexedDB, embedding in cross-origin iframes via the Intermediate Iframe API (`https:\u002F\u002Faccounts.google.com\u002Fgsi\u002Fintermediate`), configuring Content Security Policy (CSP), COOP, and Permissions Policy (`identity-credentials-get`) headers, or handling sign-out and revocation. Don't use for legacy Google Sign-In (`gapi.auth2`), Google Cloud IAM service accounts, or Android\u002FiOS native Credential Manager.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fsign-in-with-google-web\u002FSKILL.md",[82,87],{"categoryNo":83,"categoryName":84,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000009","前端开发","SCENARIO","使用场景",{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000010","后端与接口",[9,91,92,93,94,95,96,97,98,37,99,100,101,102,103,104,105,106,107,108,109,110,111,112],"sign in with google web","sign","with","web","android","go","security","google workspace","implement","policy","python","implementing","react","iam","permissions","buttons","secure","manager","identity","architectures","domain","runtimes",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":128,"publishedAt":38},"01M6998PHPDCAD684VW5WRG83D","dpop-adoption","Implement and debug OAuth 2.0 DPoP (RFC 9449) refresh token sender-constraining for WebCrypto, Node.js ES6, and browser runtimes integrating with Google's OAuth platform. Use when configuring non-extractable asymmetric key pairs (P-256), generating DPoP Proof JWTs for authorization code exchange and token refresh, or handling 400 use_dpop_nonce challenge retry loops at oauth2.googleapis.com\u002Ftoken. Don't use for unconstrained OAuth 2.0 flows (where refresh tokens are not bound to a client key pair), or for Google Cloud IAM \u002F service account authentication.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fidentity\u002Fdpop-adoption\u002FSKILL.md",[119,120,123],{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":121,"categoryName":122,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[129,130,9,37,131,132,133,134,135,136,104,137,138,139,140,141,142,109,112,143,25],"dpop adoption","adoption","es6","retry","authentication","flows","challenge","code","browser","loops","at","node","token","pair","platform",{"skillNo":145,"name":146,"nameZh":6,"description":147,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":148,"categories":149,"keywords":156,"publishedAt":38},"01M6998M72TC73EEAQH4XC7EXW","retrieving-developer-knowledge","Searches, retrieves, and synthesizes official Google developer documentation across Google Cloud, AI\u002FGemini, Android, Chrome, Web, Flutter, Go, Firebase, and other Google developer platforms. Integrates with the Developer Knowledge MCP server (search_documents, get_documents, answer_query) or the Developer Knowledge REST API fallback. Use when searching for gcloud CLI commands, API syntax, IAM permissions, official documentation, architectural comparisons, or product choice overviews. Don't use for local filesystem lookups or non-Google documentation.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fretrieving-developer-knowledge\u002FSKILL.md",[150,151,154,155],{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":152,"categoryName":153,"taxonomyType":85,"taxonomyTypeDesc":86},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":121,"categoryName":122,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[157,158,159,160,37,161,162,163,164,165,166,167,168,25,169,170,171,104,172,105],"retrieving developer knowledge","knowledge","developer","MCP","mcp server","official","developer documentation","get","search","local","choice","documents","query","api","across","documentation",{"skillNo":174,"name":175,"nameZh":6,"description":176,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":177,"categories":178,"keywords":179,"publishedAt":38},"01M6998J2CZEXS9BES9S3WWFKC","migrate-to-rust","Clones, analyzes, plans, and migrates legacy codebases (C++, Fortran, Java, Python, C, Shell) from a GitHub URL or local directory to a modern, high-performance, deterministic, 100% Safe Rust architecture, tracking live telemetry across every task bucket, test failure\u002Ffix cycle, and Profile-Guided Optimization (PGO) stage, and producing a first-person AI storytelling report and interactive HTML infographic. Use when migrating a GitHub repository or local codebase to Rust, porting legacy C++, Fortran, Python, or Java workloads to memory-safe Rust, designing Struct-of-Arrays (SoA) or SIMD Rust architectures, or optimizing Rust ports with LLVM PGO. Don't use for unrelated non-Rust refactoring or single-line syntax questions.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Fmigrate-to-rust\u002FSKILL.md",[],[180,181,182,183,184,185,186,187,101,188,189,190,191,192,193,166,194,195,196,25,197,198,171,199],"migrate to rust","rust","migrate","github","memory","performance","directory","safe","ports","llvm","soa","cycle","porting","fix","arrays","infographic","high-performance","URL","architecture","unrelated",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":209,"publishedAt":38},"01M6998GCC3K29WZ82KXMB9E02","finding-google-skills","Google platform decision and setup guidance, loaded on demand from Google's skill catalog. Use when a developer is choosing or setting up part of their stack, such as where to run a service, a database, storage, messaging, authentication, analytics, ads, or AI model serving, and a Google product is a reasonable candidate - whether or not a vendor is named - or when a request names a Google product or API. Brings in the matching Google skill so the answer can weigh Google options, their trade-offs, and when they are not the right fit. Skip when the stack is already settled on another provider and no Google product is named, or the task involves no platform choice.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fdevelopers\u002Ffinding-google-skills\u002FSKILL.md",[206,207,208],{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":121,"categoryName":122,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":124,"categoryName":125,"taxonomyType":126,"taxonomyTypeDesc":127},[9,210,211,212,213,143,214,215,216,217,218,133,219,24,220,167,32,221,25,222,170],"finding google skills","storage","as","messaging","model","trade-offs","provider","answer","fit","catalog","decision","database","candidate",{"skillNo":224,"name":225,"nameZh":6,"description":226,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":227,"categories":228,"keywords":231,"publishedAt":38},"01M6998DWNHTH0BS6W1CY8ZXMP","workload-manager-basics","Use this skill to manage Google Cloud Workload Manager evaluations, rules, scanned resources, and validation results by using public client libraries and the REST API. Use when you need to inspect workload best-practice rules, create and run evaluations for Google Cloud general best practices, SAP, SQL Server, or custom organizational rules, review violations, export results to BigQuery, or automate Workload Manager through client libraries because no service-specific public CLI or MCP server is available. Don't use for general Google Compute Engine instance management, VPC configuration, or standard IAM auditing.","https:\u002F\u002Fgithub.com\u002Fgoogle\u002Fskills\u002Fblob\u002Fmain\u002Fskills\u002Fcloud\u002Fworkload-manager-basics\u002FSKILL.md",[229,230],{"categoryNo":88,"categoryName":89,"taxonomyType":85,"taxonomyTypeDesc":86},{"categoryNo":121,"categoryName":122,"taxonomyType":85,"taxonomyTypeDesc":86},[232,233,108,234,9,160,235,37,161,236,237,238,239,25,240,170,104,241,242,243,244],"workload manager basics","workload","basics","cli","review","vpc","resources","inspect","you","create","libraries","server","run"]