Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A software engineer needs to deploy new revisions to an existing Cloud Run service and view application logs in a specific Google Cloud project. The engineer must not be able to modify service IAM policies, delete the service, or manage other infrastructure in the project. Which role assignment follows Google's recommended practice of least privilege?

  1. Grant the Cloud Run Developer role (roles/run.developer) on the specific Cloud Run service and the Logs Viewer role (roles/logging.viewer) at the project level.Answer
  2. B
    Grant the Editor role (roles/editor) at the project level.
  3. C
    Grant the Cloud Run Admin role (roles/run.admin) at the project level.
  4. D
    Grant the Logs Viewer role (roles/logging.viewer) at the organization level to automatically inherit deployment rights down to the project service.

Answer

Granting the Cloud Run Developer role on the specific Cloud Run service paired with the Logs Viewer role at the project level provides the minimal permissions necessary to deploy new revisions and inspect logs without allowing service deletion or project-wide administrative control.
Granting Cloud Run Developer scoped directly to the targeted Cloud Run service alongside Logs Viewer at the project level adheres strictly to least privilege by enabling revision deployments and log viewing while prohibiting service deletion, IAM policy edits, or broad project access.

Step-by-Step Solution

1
Identify the minimum required operations.
The user needs to deploy revisions to a single Cloud Run service and inspect project execution logs.
Following the principle of least privilege requires isolating the scope to only required operations.
2
Evaluate role selection between Primitive and Predefined roles.
Select Cloud Run Developer (roles/run.developer) instead of primitive Editor or broad Cloud Run Admin roles.
Predefined roles target specific service capabilities without exposing administrative actions like deleting resources or editing security policies.
3
Determine appropriate resource scoping in the GCP hierarchy.
Bind Cloud Run Developer on the specific service resource rather than project-wide, and bind Logs Viewer at the project level.
Scoping resource-level access limits actions strictly to the intended resource.

Key Concept

Principle of Least Privilege using Predefined IAM Roles
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic