https://cloud.google.com/logging/docs/export/troubleshoot
Unable to grant correct permissions to the destination:
Even if the sink was successfully created with the correct service account permissions, this error message displays if the access control model for the Cloud Storage bucket was set to uniform access when the bucket was created.
For existing Cloud Storage buckets, you can change the access control model for the first 90 days after bucket creation by using the Permissions tab. For new buckets, select the Fine-grained access control model during bucket creation. For details, see Creating Cloud Storage buckets.

https://support.google.com/a/answer/6178640?hl=en
The transfer tool enables you to see what unmanaged users exist, and then invite those unmanaged users to the domain.

https://cloud.google.com/vpc-service-controls/docs/ingress-egress-rules#definition-ingress-egress

https://cloud.google.com/storage/docs/public-access-prevention
Public access prevention protects Cloud Storage buckets and objects from being accidentally exposed to the public.
If your bucket is contained within an organization, you can enforce public access prevention by using the organization policy constraint storage.publicAccessPrevention at the project, folder, or organization level.