Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An organization needs to grant a newly onboarded team of data analysts access to process datasets within a Google Cloud project named `analytics-prod`. The analysts must be able to read files stored inside Cloud Storage buckets in this project and run BigQuery SQL queries to analyze data. They must not be permitted to create or delete Cloud Storage buckets, modify object contents, or manage BigQuery dataset permissions. Which TWO predefined IAM roles should be assigned to the analysts' Google Group at the project level to meet these requirements while following the principle of least privilege?

  1. Storage Object Viewer (roles/storage.objectViewer)Answer
  2. BigQuery Job User (roles/bigquery.jobUser)Answer
  3. C
    Editor (roles/editor)
  4. D
    Storage Admin (roles/storage.admin)

Answer

The data analysts should be granted the Storage Object Viewer role (roles/storage.objectViewer) and the BigQuery Job User role (roles/bigquery.jobUser) at the project level.
The combination of Storage Object Viewer and BigQuery Job User fulfills the exact operational needs of reading bucket objects and running BigQuery SQL queries without granting unnecessary permissions to edit resources or manage administrative settings.

Step-by-Step Solution

1
Identify the minimum required Cloud Storage permissions for reading bucket contents.
Selecting Storage Object Viewer provides object read access while preventing object deletion, modification, or bucket administrative operations.
Adheres to least privilege for Cloud Storage data access.
2
Identify the minimum required BigQuery permissions for running SQL query jobs.
Selecting BigQuery Job User grants permission to run jobs within the project without providing permissions to alter dataset permissions or table schemas.
Adheres to least privilege for BigQuery computational job execution.
3
Reject broad primitive roles and administrative predefined roles.
Eliminate roles such as Editor or Storage Admin as they grant unnecessary administrative or write capabilities.
Prevents security risk from over-privileged role bindings.

Key Concept

Applying Least-Privilege Predefined IAM Roles for Multi-Resource Access
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic