Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A data analyst needs to execute SQL queries in BigQuery and read table contents within a specific dataset named `sales_data` inside the `corp-analytics-prod` project. Following Google Cloud best practices for least privilege, the analyst must not be able to modify any data or access other datasets within the project. Which IAM role assignment strategy should be implemented?

  1. Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level and the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.Answer
  2. B
    Grant the Editor primitive role (roles/editor) at the project level.
  3. C
    Grant the BigQuery Admin role (roles/bigquery.admin) at the project level and explicitly deny access to all other datasets.
  4. D
    Grant the Billing Account User role (roles/billing.user) at the billing account level to authorize query computation.

Answer

Grant the BigQuery Job User role (roles/bigquery.jobUser) at the project level and the BigQuery Data Viewer role (roles/bigquery.dataViewer) at the dataset level.
To execute BigQuery queries, a user needs the project-level permission `bigquery.jobs.create`, provided by `roles/bigquery.jobUser`. To read data strictly within a specific dataset without accessing others in the project, `roles/bigquery.dataViewer` must be granted at the dataset level. This combination satisfies least-privilege requirements.

Step-by-Step Solution

1
Identify the required operational permission to execute BigQuery jobs.
Creating and running jobs requires project-level authorization, which is provided by the predefined role roles/bigquery.jobUser.
Job execution is a project-scoped action in Google Cloud BigQuery.
2
Identify the required data access permission scoped to the specific target resource.
Reading table data within the specific dataset requires roles/bigquery.dataViewer assigned directly on the target dataset resource.
Granting data permissions at the dataset level prevents access to other datasets in the project.
3
Combine the permissions following the principle of least privilege.
The user obtains minimum required capabilities without excess permissions or broad primitive roles.
This separation ensures compliance with GCP security recommendations.

Key Concept

Applying Least-Privilege IAM Roles for BigQuery Access Across Resource Hierarchy Levels
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic