Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

A backend development team requires permissions to publish messages to existing Cloud Pub/Sub topics and pull messages from existing subscriptions within the `app-messaging-prod` project. The team must not be permitted to create, modify, or delete Pub/Sub topics or subscriptions, nor should they receive access to any other projects within the resource hierarchy. Which TWO IAM role bindings should be granted to the team's principal group to adhere to the Principle of Least Privilege?

  1. Grant the Pub/Sub Publisher role (roles/pubsub.publisher) on project app-messaging-prod.Answer
  2. Grant the Pub/Sub Subscriber role (roles/pubsub.subscriber) on project app-messaging-prod.Answer
  3. C
    Grant the Editor role (roles/editor) on project app-messaging-prod.
  4. D
    Grant the Pub/Sub Admin role (roles/pubsub.admin) at the parent Folder level containing app-messaging-prod.

Answer

Granting the Pub/Sub Publisher role (roles/pubsub.publisher) and the Pub/Sub Subscriber role (roles/pubsub.subscriber) bound at the specific project level (app-messaging-prod).
To satisfy least privilege requirements for message publishing and consumption in a single project, specific predefined roles—Pub/Sub Publisher and Pub/Sub Subscriber—must be assigned directly on the target project. This ensures the team can execute message data operations without receiving topic creation privileges or permissions on other projects.

Step-by-Step Solution

1
Analyze the operational requirements.
The team only needs to publish messages and consume/acknowledge messages from existing Pub/Sub resources.
Administrative rights such as creating or deleting topics/subscriptions are explicitly forbidden.
2
Select predefined IAM roles matching the principle of least privilege.
The Pub/Sub Publisher (roles/pubsub.publisher) and Pub/Sub Subscriber (roles/pubsub.subscriber) roles provide granular access for publishing and message consumption respectively.
Primitive roles like Editor grant overly broad permissions across multiple GCP services.
3
Identify the correct resource hierarchy scope.
Bind the predefined roles directly at the target project level (`app-messaging-prod`).
Binding roles at a parent Folder or Organization level would inherit permissions down to unintended sibling projects.

Key Concept

Granting Granular Predefined IAM Roles at the Target Project Scope under Least Privilege
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic