Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A background data processing pipeline requires access to send telemetry events to Cloud Pub/Sub topics located within a dedicated analytics project. The service account assigned to the pipeline should only have permissions to publish messages, without the ability to create topics, read messages from subscriptions, or alter topic configurations. To adhere to the principle of least privilege, which IAM role configuration should be applied to the service account?

  1. Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.Answer
  2. B
    Grant the Editor (roles/editor) role at the project level.
  3. C
    Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the organization level.
  4. D
    Grant the Pub/Sub Admin (roles/pubsub.admin) role at the project level.

Answer

Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.
Granting the predefined Pub/Sub Publisher role at the project level satisfies the principle of least privilege by providing only the permissions needed to publish messages within the designated project, preventing excessive access to non-required actions or other projects.

Step-by-Step Solution

1
Identify the required permissions based on operational needs.
The pipeline requires only message publishing capability (pubsub.topics.publish).
Least privilege mandates granting only permissions essential for the workload.
2
Select the appropriate IAM role type.
Select the predefined role 'roles/pubsub.publisher' instead of primitive roles or overly broad admin predefined roles.
Predefined roles provide fine-grained permissions tailored to specific job functions.
3
Determine the minimum resource hierarchy scope.
Apply the role binding at the project level containing the Pub/Sub topics.
Binding at higher levels (Organization or Folder) inherits downstream and grants unnecessary access across other projects.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scoping in GCP IAM
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic