Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An organization is setting up continuous deployment pipelines for a containerized application that interacts with a Cloud Spanner database in a single target project named `prod-app-services`. The automated service account used by the deployment pipeline needs permission to deploy updated Cloud Run services and execute database schema modifications in Cloud Spanner. The security architecture policy strictly mandates applying the Principle of Least Privilege and restricting role scope to only the necessary project. Which TWO IAM role bindings should be granted to the service account? (Select TWO.)

  1. Cloud Run Developer (roles/run.developer) on the `prod-app-services` projectAnswer
  2. B
    Editor (roles/editor) on the `prod-app-services` project
  3. Cloud Spanner Database Admin (roles/spanner.databaseAdmin) on the `prod-app-services` projectAnswer
  4. D
    Cloud Run Admin (roles/run.admin) bound at the Organization root level

Answer

Granting Cloud Run Developer and Cloud Spanner Database Admin roles on the specific target project fulfills all operational needs while adhering to least privilege.
To satisfy least privilege for a pipeline managing Cloud Run deployments and Cloud Spanner schemas, specific predefined roles targeting those exact services must be chosen. The Cloud Run Developer role allows deploying and updating Cloud Run services without full administrative control over unrelated compute infrastructure. The Cloud Spanner Database Admin role allows creating, editing, and applying DDL schema updates to databases. Both bindings must be restricted to the specific target project.

Step-by-Step Solution

1
Analyze the operational requirements of the deployment pipeline identity.
The pipeline requires permissions to deploy Cloud Run revisions and modify Cloud Spanner database schemas.
Identifying necessary capabilities determines which resource-specific roles are required.
2
Filter roles according to the Principle of Least Privilege.
Cloud Run Developer (roles/run.developer) grants service management permissions without full admin rights, while Cloud Spanner Database Admin (roles/spanner.databaseAdmin) allows database and DDL maintenance. Primitive roles like Editor grant unnecessary permissions across other GCP services and must be avoided.
Predefined roles tailored to specific service duties prevent over-provisioning permissions.
3
Determine the required Resource Hierarchy scope for the role binding.
The bindings must be placed directly on the `prod-app-services` project. Organization-level bindings would inherit downward to all projects, violating scope restrictions.
IAM permissions inherit down the resource hierarchy (Organization → Folder → Project → Resource), so bindings must be placed at the lowest sufficient level.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in GCP IAM
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic