Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

A software engineer needs to upload container images to Google Artifact Registry repositories within a development project. Following the principle of least privilege, which IAM role should you grant to the engineer?

  1. Artifact Registry Writer (`roles/artifactregistry.writer`) on the projectAnswer
  2. B
    Editor (`roles/editor`) on the project
  3. C
    Artifact Registry Administrator (`roles/artifactregistry.admin`) at the Organization level
  4. D
    Owner (`roles/owner`) on the project

Answer

Grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) scoped to the specific project.
The Artifact Registry Writer role (`roles/artifactregistry.writer`) provides permissions to read and write repositories, which enables pushing container images. Granting this predefined role at the project level meets the functional requirement while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the required operational permission
The engineer specifically needs permission to upload (push) container images to Artifact Registry repositories.
Understanding the precise capability needed allows selecting the narrowest matching IAM role.
2
Apply the Principle of Least Privilege
Select the predefined role `roles/artifactregistry.writer` over broad primitive roles or administrative predefined roles.
Predefined roles provide targeted permissions for specific service actions without exposing administrative capabilities or other GCP services.
3
Scope the role binding appropriately
Bind the role at the target project level rather than higher up in the resource hierarchy.
IAM roles inherit down the resource hierarchy; granting access at the project level restricts access to resources within that project.

Key Concept

Selecting specific Predefined Roles over broad Primitive Roles to satisfy the Principle of Least Privilege.
Estimated Time:45s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic