An enterprise security engineer must configure conditional IAM access for a cloud operational team at the project level. The access must grant the Cloud Functions Developer predefined role (`roles/cloudfunctions.developer`) only for resources whose names start with `prod-`. What is the correct sequential order of steps to programmatically apply and verify this conditional IAM policy update using the `gcloud` CLI?
- 1Execute `gcloud projects get-iam-policy PROJECT_ID --format=json > policy.json` to save the current project-level IAM policy locally.
- 2Edit `policy.json` to add a new binding containing `roles/cloudfunctions.developer`, the principal identifier, and an IAM condition expression filtering resource names.
- 3Execute `gcloud projects set-iam-policy PROJECT_ID policy.json` to push the updated IAM access configuration to the project.
- 4Execute `gcloud projects get-iam-policy PROJECT_ID --filter="bindings.role:roles/cloudfunctions.developer"` to inspect and confirm the active conditional role assignment.
Answer
The correct operational sequence is: 1) Export the current project policy to a JSON file, 2) Edit the JSON file to append the predefined role binding with the resource name condition, 3) Write the updated policy back to the project using `set-iam-policy`, and 4) Verify the updated policy bindings using `get-iam-policy` with a filter.
The complete workflow requires retrieving the current live policy via `gcloud projects get-iam-policy` into a local JSON file to safeguard existing permissions, modifying the JSON structure to include the predefined role and condition block, writing the policy back using `gcloud projects set-iam-policy`, and verifying the binding with a filtered `get-iam-policy` command.
Step-by-Step Solution
Key Concept
Managing IAM Roles and Resource Access Permissions via gcloud CLI Policy Files