An organization is configuring security policies for container image management within a Google Cloud project named `prod-app-repo`. An application deployment team requires access to push and pull container images in Artifact Registry repositories in this project. Simultaneously, a compliance auditor needs read-only access to view repository metadata without the ability to modify or delete artifacts. Adhering strictly to the principle of least privilege, which two IAM configuration actions should you perform? (Select TWO.)
- Grant `roles/artifactregistry.writer` to the application deployment team on project `prod-app-repo`.Answer
- Grant `roles/artifactregistry.reader` to the compliance auditor on project `prod-app-repo`.Answer
- CGrant `roles/editor` to the application deployment team on project `prod-app-repo`.
- DGrant `roles/artifactregistry.writer` to the application deployment team at the parent Folder level containing `prod-app-repo`.
Answer
Grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) to the deployment team at the project level, and grant the Artifact Registry Reader role (`roles/artifactregistry.reader`) to the compliance auditor at the project level.
To satisfy least privilege for container management, the application deployment team should be assigned the predefined Artifact Registry Writer role (`roles/artifactregistry.writer`) at the project level, granting necessary push and pull permissions without excess access. The auditor should be assigned the Artifact Registry Reader role (`roles/artifactregistry.reader`) at the project level, which limits access to viewing repository items and metadata.
Step-by-Step Solution
Key Concept
Selecting specific predefined IAM roles at the appropriate resource hierarchy scope in accordance with the Principle of Least Privilege.