Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A Cloud Engineer is configuring IAM permissions for a dedicated service account used by a Cloud Function. The function must pull messages from a specific Cloud Pub/Sub subscription and upload processed results into a specific Cloud Storage bucket. Following the principle of least privilege, which two IAM role assignments should be granted to the service account?

  1. Grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) scoped directly to the target Pub/Sub subscription.Answer
  2. Grant the Storage Object Creator role (roles/storage.objectCreator) scoped directly to the target Cloud Storage bucket.Answer
  3. C
    Grant the primitive Editor role (roles/editor) at the Cloud Project level to cover both Pub/Sub and Storage access.
  4. D
    Grant the Storage Admin role (roles/storage.admin) at the Organization level so that permissions inherit down to the bucket.

Answer

Grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) scoped to the specific subscription, and grant the Storage Object Creator role (roles/storage.objectCreator) scoped to the specific Cloud Storage bucket.
To adhere to the principle of least privilege, access must be limited to predefined roles that grant only the required permissions, bound directly to the target resources (the specific Pub/Sub subscription and Cloud Storage bucket). The Pub/Sub Subscriber role on the subscription allows pulling messages, while the Storage Object Creator role on the bucket permits writing output objects without granting read, list, or deletion capabilities.

Step-by-Step Solution

1
Identify the specific resource interactions required for the service account.
The workload requires pulling Pub/Sub subscription messages and writing object files into a single Cloud Storage bucket.
Understanding exact functional needs is essential for defining fine-grained roles.
2
Select predefined roles over primitive roles.
Use roles/pubsub.subscriber for Pub/Sub consumption and roles/storage.objectCreator for bucket object writes instead of primitive roles like Editor.
Predefined roles restrict actions to specific resource operations, upholding least privilege.
3
Apply role bindings at the lowest relevant resource hierarchy level.
Bind roles at the specific subscription and bucket resource levels rather than project or organization levels.
Resource hierarchy inheritance applies access down all child resources, so restricting the binding scope prevents unintended access.

Key Concept

Applying Least Privilege via Predefined Roles and Fine-Grained Resource Scope Binding
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic