Alert streaming and investigation access use separate identities
Alert delivery
Your Cloud Logging sink selects entries by minimum severity and chosen Cloud Run, GKE, or Compute Engine resources. Its writer identity publishes matching entries to Corvo’s Pub/Sub destination. Corvo collects them into investigation windows and assigns them to investigations. The sink’s inclusion filter controls which entries leave the project. Selecting a parent in the source picker includes future resources beneath it.Investigation access
Thecorvo-agent service account lives in your project and has the read roles selected during onboarding. Corvo’s runtime identity has Service Account Token Creator on that account, so it can obtain a short-lived token and read available evidence. It does not need a downloaded service account key.
The sink writer’s publishing permission and corvo-agent’s read roles are independent. Stopping streaming removes the writer’s access to Corvo’s destination; it does not remove the sink or the read roles. See Google Cloud setup for the exact Console steps.