Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A Cloud Engineer needs to create a project-level custom IAM role from a definition file (`custom-role.yaml`) and assign it to a service account (`[email protected]`) in the project `my-project`. Place the required command line operations and configuration steps in the correct chronological order from first to last to enforce least privilege access securely.

  1. 1Define the target permissions, title, stage, and description inside a local YAML file named `custom-role.yaml`.
  2. 2Run `gcloud iam roles create CustomRoleID --project=my-project --file=custom-role.yaml` to register the custom role.
  3. 3Run `gcloud projects add-iam-policy-binding my-project --member="serviceAccount:[email protected]" --role="projects/my-project/roles/CustomRoleID"` to assign permissions.
  4. 4Verify the updated IAM policy using `gcloud projects get-iam-policy my-project` to confirm successful access granting.

Answer

The correct sequence starts by authoring the `custom-role.yaml` permissions file, followed by creating the custom role in the project with `gcloud iam roles create`, binding the custom role to the service account using `gcloud projects add-iam-policy-binding`, and finally verifying the policy update with `gcloud projects get-iam-policy`.
Creating and granting custom IAM permissions in Google Cloud requires defining the role specification file first, creating the role in the project hierarchy, attaching the role binding to the service account member, and finally auditing the updated IAM policy.

Step-by-Step Solution

1
Define the role manifest (`custom-role.yaml`) with necessary permissions such as `storage.objects.get`.
Local YAML file ready for gcloud role creation input.
gcloud requires a valid configuration manifest or parameter list to establish custom role definitions.
2
Execute `gcloud iam roles create` targeting the specific project with `--file=custom-role.yaml`.
The custom IAM role is created under `projects/my-project/roles/CustomRoleID`.
The role must exist before IAM policy bindings can reference its full resource name.
3
Execute `gcloud projects add-iam-policy-binding` with the `--member` and `--role` flags.
The principal is granted access permissions defined in the custom role.
Assigning roles to principals at the resource level establishes access control rules.
4
Execute `gcloud projects get-iam-policy` to inspect current project permissions.
Confirmation that the service account member is bound to the new role.
Auditing and verifying IAM bindings ensures compliance and confirms least privilege implementation.

Key Concept

Managing IAM Roles and Resource Access Permissions
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic