configuring-log-export
Pass
Audited by Gen Agent Trust Hub on Jul 22, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides step-by-step instructions for configuring log and metric export via official command-line interfaces including
ccloud,aws, andgcloud. All operations are consistent with the stated administrative purpose. - [SAFE]: Secret management follows best practices by using descriptive placeholders (e.g.,
<datadog-api-key>,<iam-role-arn>) instead of hardcoded credentials. It correctly instructs users to manage secrets via cloud provider IAM roles or external service configurations. - [SAFE]: Provided IAM policy templates for AWS and GCP adhere to the principle of least privilege. For example, the AWS log export policy is scoped specifically to CloudWatch log groups matching the
cockroachdb-*prefix, and the metric export policy is restricted to theCockroachDBnamespace.
Audit Metadata