How to use the Cross-Project Cloud Logging Setup agent skill

What an agent skill is and what this one makes the agent do

An agent skill is a folder with a SKILL.md file that tells an AI agent how to handle a specific kind of task. When this skill is installed, the agent follows its steps for cross-project logging in Google Cloud.

The skill helps the agent pick one of two designs. In centralized storage, logs from source projects are routed by sinks into one central log bucket. In read-time aggregation, logs stay in the projects where they originate and a single query, using log scopes, reads them together. The agent then runs the matching gcloud commands.

• Compares the two designs using criteria such as project scale, SQL analytics, access control, configuration complexity and cost.
• Creates a regional log bucket with Log Analytics enabled in a central project, following the skill's setup steps.
• Helps troubleshoot cross-project routing.
• Does not cover single-project logging setups; the skill says it is not for those.

Install the skill from the ZIP file

Download the ZIP file for this skill from this page. Then install it in one of the following ways.

For a personal install that applies to all your work, unzip the folder into ~/.claude/skills/. To limit the skill to one project, unzip it into that project's .claude/skills/ folder.

If you use the Claude apps, you can upload the skill instead. Go to Settings, then Capabilities, then Skills, and upload the ZIP there.

• Personal install: ~/.claude/skills/
• Project install: .claude/skills/ inside your project
• Claude apps: Settings → Capabilities → Skills

Check the requirements before you start

The skill cannot do useful work without a working Google Cloud setup. Confirm these three things first.

The skill also states that it does not replace your access rights. The agent acts with your gcloud login, so it can only do what your account is allowed to do.

• Google Cloud SDK (gcloud CLI) is installed and authenticated, with suitable IAM permissions.
• You have access to the projects, folders or organizations involved.
• Your machine has network access to Google Cloud APIs when the agent runs live commands.

How to trigger the skill with natural requests

You do not need special syntax. The skill is meant to be picked up when your request matches its use cases: setting up log routing from several projects to a central bucket, creating cross-project log sinks, or troubleshooting cross-project routing.

Name the projects and the goal in your request. Use real project IDs or placeholders such as {central_project_id} and {source_project_id}, because the skill tells the agent to use the IDs you give it.

• Set up a central log bucket in my logging project and route logs from my three source projects into it.
• Why are logs from project payments-prod not reaching the central bucket in project central-logs?
• Compare centralized storage and read-time aggregation for our 200 projects and tell me which fits.
• Draft the gcloud commands to create a sink from folder logs into the central bucket, and ask me before anything that changes access or costs money.

Choose centralized storage or read-time aggregation

Centralized storage scales to thousands of projects, stores logs in one bucket, and makes SQL analytics easy through Observability Analytics. Access is scoped through log views on the central bucket. Its cost can rise through duplicate storage if exclusions are not set.

Read-time aggregation is best for fewer than 375 projects. Logs stay in their originating resources, which is cost-effective because there is no data replication, and it does not interfere with bucket-based log-based metrics. SQL analytics is harder because you query multiple buckets, and access requires IAM on all the views.

Know which actions run without asking

The skill sorts gcloud actions into four tiers. Read-only commands such as gcloud logging read and gcloud logging buckets list run immediately. Non-billing configuration changes, such as creating views or log buckets, can also run without confirmation. This means the agent may apply some changes without asking you first.

Tier B covers actions that create billing-inducing resources or change IAM policies, such as gcloud logging metrics create and gcloud projects add-iam-policy-binding. The agent must show you the exact command and wait for your confirmation. Tier D covers actions that permanently discard logs, such as deleting a bucket or adding a sink exclusion. The agent must ask you to type an explicit confirmation, for example 'Yes, discard logs', and stop until you reply.

• Tier R: read-only, runs immediately.
• Tier M: non-billing changes, runs without confirmation.
• Tier B: billing or security changes, needs confirmation before execution.
• Tier D: permanent log loss, needs typed confirmation.

Safety notes: scripts, network and attribution

The skill runs scripts and uses the network, as listed in its requirements. Before the agent runs commands against real projects, review them yourself. The skill's own instructions say that some mutating commands can run without confirmation.

The skill contains a sandbox note. In restricted or evaluation environments, it tells the agent not to run network discovery commands to find resource names, project IDs or organization IDs, and to use the IDs you supply instead. Running discovery there can hang and time out.

The skill also requires a usage attribution tag. For gcloud commands run directly in the terminal, it sets a metrics environment variable on each command, and it adds the same identifier to User-Agent headers for direct HTTP calls. It does not use gcloud config set for this, so the tag does not persist.

• Read the commands before approving them, especially in real projects.
• Expect some Tier M commands to run without a prompt.
• Expect the attribution tag on terminal gcloud commands; it identifies the skill and its version only.