Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A cloud engineer needs to configure least-privilege access by creating a custom IAM role for specific virtual machine operations and assigning it to an operator in a Google Cloud project using the gcloud CLI. Place the following operational steps in the correct sequential order from start to finish.

  1. 1Create a local YAML configuration file specifying the custom role metadata, title, and fine-grained permissions (such as compute.instances.start and compute.instances.stop).
  2. 2Execute the command 'gcloud iam roles create customVmOperator --project=prod-project-123 --config-file=role-definition.yaml' to instantiate the role.
  3. 3Execute the command 'gcloud projects add-iam-policy-binding prod-project-123 --member="user:[email protected]" --role="projects/prod-project-123/roles/customVmOperator"' to grant access.
  4. 4Execute the command 'gcloud projects get-iam-policy prod-project-123' to audit and confirm the newly established policy binding.

Answer

The correct sequence of operations is: first, create the local YAML role definition file specifying the required permissions; second, run 'gcloud iam roles create' to instantiate the custom role in the project; third, run 'gcloud projects add-iam-policy-binding' to bind the custom role to the user; and fourth, run 'gcloud projects get-iam-policy' to audit and confirm the binding.
The workflow follows standard Google Cloud IAM administration procedures: defining role permissions in a configuration file, creating the custom role resource in the target project, binding the created role to the desired user identity, and verifying the policy change via policy retrieval commands.

Step-by-Step Solution

1
Draft the custom role specification file containing the required permissions.
A local YAML configuration file ready for CLI creation commands.
Permissions must be defined prior to registering the custom role resource in Google Cloud.
2
Run 'gcloud iam roles create' referencing the YAML definition file.
The custom role is registered under the project's IAM role scope.
A role must exist in GCP IAM before any principal can be bound to it.
3
Run 'gcloud projects add-iam-policy-binding' to assign the custom role to the user.
The IAM policy binding links the user principal to the custom role resource.
Granting permissions requires binding the identity member to the role path at the appropriate hierarchy level.
4
Run 'gcloud projects get-iam-policy' to inspect the updated project policy.
An output listing current policy bindings confirming successful role assignment.
Verifying policy state ensures security compliance and confirms administrative changes were committed.

Key Concept

Custom IAM Role Creation and Policy Binding Lifecycle via gcloud CLI
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic