Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

Your enterprise organization needs to author, test, and release a custom IAM role at the organization level using a declarative definition. Place the operational steps in the correct sequential order to create, evaluate, and promote the custom IAM role using the gcloud CLI following Google Cloud best practices.

  1. 1Draft a local YAML definition file specifying the role title, description, required permissions, and set the launchStage attribute to ALPHA.
  2. 2Execute gcloud iam roles create using the --organization flag and referencing the YAML file via the --file parameter.
  3. 3Grant the new organization-level custom role to a test service account on a staging project using gcloud projects add-iam-policy-binding to validate permission behavior.
  4. 4Modify the launchStage attribute to GA in the YAML file and run gcloud iam roles update with the --organization and --file flags.

Answer

The correct sequence begins with drafting the local YAML role definition file with launchStage set to ALPHA, followed by creating the role at the organization level with gcloud iam roles create, testing the role assignment on a project via gcloud projects add-iam-policy-binding, and finally updating the role's launch stage to GA via gcloud iam roles update.
Declarative custom IAM role creation follows a structured lifecycle: defining the specification in YAML with an initial ALPHA stage, instantiating the role in GCP using gcloud iam roles create, testing permission effectiveness by binding the role to a test principal, and finally updating the role's launch stage to GA using gcloud iam roles update.

Step-by-Step Solution

1
Define the custom role structure locally in YAML.
A valid YAML configuration file containing title, description, permissions list, and ALPHA launch stage.
gcloud CLI declarative role creation requires a pre-configured YAML file containing the permission payload.
2
Create the organization custom role via gcloud CLI.
The custom IAM role is instantiated at the organization resource level.
Creating the role makes its resource identifier available across child projects in the resource hierarchy.
3
Bind the role to a service account for integration testing.
The identity receives the defined permissions within the specific test project scope.
Testing the ALPHA role validates that no required permissions were omitted from the custom role definition.
4
Promote the custom role to GA status via gcloud iam roles update.
The role lifecycle stage updates to GA, signaling readiness for enterprise production workloads.
Updating the YAML launchStage and executing the update command updates the official lifecycle metadata of the role.

Key Concept

Custom IAM Role Lifecycle and Declarative Management via gcloud CLI
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic