Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

You need to grant a developer access to view and download objects stored within a specific Cloud Storage bucket in your project. Following Google Cloud best practices and the principle of least privilege, which IAM role should you assign?

  1. Storage Object Viewer (roles/storage.objectViewer)Answer
  2. B
    Viewer (roles/viewer)
  3. C
    Editor (roles/editor)
  4. D
    Billing Account Viewer (roles/billing.viewer)

Answer

The correct role is Storage Object Viewer (roles/storage.objectViewer).
The Storage Object Viewer role (roles/storage.objectViewer) grants read-only access to storage objects within Cloud Storage. Predefined roles are recommended by Google Cloud because they follow the principle of least privilege by providing only the permissions necessary for the specific task.

Step-by-Step Solution

1
Identify the required operational task
The user needs to view and download objects from a Cloud Storage bucket.
Understanding the precise permissions needed is essential for adhering to least privilege access.
2
Evaluate role types following GCP best practices
Avoid primitive roles (Viewer, Editor, Owner) when specific predefined roles exist.
Primitive roles grant broad access to almost all GCP services in the project, whereas predefined roles scope permissions down to specific service tasks.
3
Select the appropriate predefined IAM role
Storage Object Viewer provides permissions to read and list bucket objects specifically.
This grants exactly the required permissions without unnecessary administrative privileges.

Key Concept

Principle of Least Privilege using Predefined IAM Roles
Estimated Time:45s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic