Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A data analytics team needs to grant a newly onboarded junior analyst access to execute queries and read data in BigQuery within a specific Google Cloud project named `analytics-prod`. The analyst must not be able to modify existing tables, delete datasets, or access non-BigQuery resources within the project. Which IAM role assignment follows Google Cloud best practices and the principle of least privilege to fulfill this requirement?

  1. Grant the user the BigQuery Data Viewer (roles/bigquery.dataViewer) and BigQuery Job User (roles/bigquery.jobUser) predefined roles at the project level.Answer
  2. B
    Grant the user the Viewer (roles/viewer) primitive role at the project level.
  3. C
    Grant the user the BigQuery Admin (roles/bigquery.admin) predefined role at the Organization level.
  4. D
    Grant the user the Editor (roles/editor) primitive role at the parent Folder level.

Answer

Grant the user the BigQuery Data Viewer (roles/bigquery.dataViewer) and BigQuery Job User (roles/bigquery.jobUser) predefined roles at the project level.
To run queries and view dataset contents in BigQuery, a principal requires permission to run query jobs (`roles/bigquery.jobUser`) and read table data (`roles/bigquery.dataViewer`). Granting these predefined roles at the project level enforces the principle of least privilege by restricting access specifically to BigQuery tasks in the target project.

Step-by-Step Solution

1
Identify the required permissions for running queries and reading BigQuery data.
The user needs permission to read dataset contents and permission to run BigQuery jobs (queries).
Running a query requires job creation permissions, while accessing dataset records requires data viewing permissions.
2
Select predefined IAM roles that match the exact permission scope without granting extraneous access.
`roles/bigquery.dataViewer` permits reading data, and `roles/bigquery.jobUser` permits running query jobs.
Predefined roles conform to the principle of least privilege, unlike primitive roles like Viewer or Editor.
3
Determine the proper resource hierarchy level for binding the IAM roles.
Bind the roles at the `analytics-prod` project level.
Applying roles at higher levels such as Folder or Organization would grant access to unrelated projects due to IAM policy inheritance.

Key Concept

Principle of Least Privilege with Predefined IAM Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic