An operations engineer is responsible for maintaining system availability in a Google Cloud project named `prod-services`. The engineer currently holds the Monitoring Viewer (`roles/monitoring.viewer`) IAM role but receives a permission error when attempting to configure new alerting policies and notification channels in Cloud Monitoring. Following Google-recommended practices and the principle of least privilege, which action should be taken to resolve this issue?
- Grant the engineer the Monitoring Editor (`roles/monitoring.editor`) role on the `prod-services` project.Answer
- BGrant the engineer the Editor (`roles/editor`) primitive role on the `prod-services` project.
- CGrant the Monitoring Viewer role at the Organization level to override project-level policy restriction rules.
- DEnable the Cloud Monitoring API in the organization's central billing project instead of the `prod-services` project.
Answer
Grant the engineer the Monitoring Editor (`roles/monitoring.editor`) role on the `prod-services` project.
The Monitoring Editor (`roles/monitoring.editor`) predefined role includes all necessary permissions to create, update, and delete Cloud Monitoring alerting policies, uptime checks, and notification channels. It aligns with the principle of least privilege by scope-limiting access strictly to observability resources within the target project.
Step-by-Step Solution
Key Concept
Cloud Monitoring IAM Roles and Least Privilege Access Control