If the objective is to remove excess permissions, then IAM recommender is a great fit as it's designed for that. It takes into account group memberships and custom roles; it recommends different actions like either removing or replacing a role (with ...

Generally, we recommend using the more cloud-native push-based method to export logs from Pub/Sub to your third-party tool. That method is simpler and more secure as it doesn't require you to grant external access or manage service account keys and t...