Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An enterprise operations team needs to allow a database administrator to create, update, and manage Cloud SQL database instances within project `proj-finance-db-4091`. The administrator must not receive read access to data stored inside the databases or permissions to manage non-database cloud resources. To adhere strictly to the Principle of Least Privilege, which identity configuration should you apply?

  1. A
    Grant the Editor (roles/editor) primitive role to the user on project proj-finance-db-4091.
  2. Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role to the user on project proj-finance-db-4091.Answer
  3. C
    Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role to the user at the parent Folder level containing the project.
  4. D
    Grant the Owner (roles/owner) primitive role to the user at the Organization level.

Answer

Grant the Cloud SQL Admin (roles/cloudsql.admin) predefined role bound specifically at project scope (proj-finance-db-4091).
Granting the Cloud SQL Admin (`roles/cloudsql.admin`) predefined role at the specific project scope (`proj-finance-db-4091`) strictly limits administrative permissions to Cloud SQL instances within that specific project, fully satisfying the Principle of Least Privilege.

Step-by-Step Solution

1
Identify the required permissions and target service
The requirement specifies managing Cloud SQL database instances without access to underlying data or non-database resources.
Selecting a predefined role targeted specifically at Cloud SQL enforces the Principle of Least Privilege.
2
Determine the minimum role type needed
The predefined role `roles/cloudsql.admin` provides instance management capabilities without granting access to unrelated services.
Primitive roles like Editor or Owner grant excessive privileges across all services in GCP.
3
Determine the precise resource hierarchy binding scope
The IAM policy binding must be created directly on project `proj-finance-db-4091`.
Binding roles at higher nodes (Folder or Organization) causes inherited access across all child projects in that scope.

Key Concept

Applying Least Privilege via Predefined Roles at Project Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic