Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

A DevOps team is setting up an automated deployment pipeline for a microservice in a GCP project named `project-staging`. The pipeline's dedicated service account must be able to push compiled container images to an Artifact Registry repository named `app-repo` and manage Kubernetes deployments within the project's GKE cluster. Following the principle of least privilege, which TWO role assignments should the team grant to the service account? (Select TWO.)

  1. Grant the Artifact Registry Writer (roles/artifactregistry.writer) role to the service account on the app-repo repository.Answer
  2. Grant the Kubernetes Engine Developer (roles/container.developer) role to the service account on project-staging.Answer
  3. C
    Grant the Editor (roles/editor) primitive role to the service account on project-staging.
  4. D
    Grant the Kubernetes Engine Admin (roles/container.admin) role to the service account at the parent Folder level.

Answer

The team should grant the Artifact Registry Writer role on the app-repo repository resource and the Kubernetes Engine Developer role on the project-staging project resource.
To satisfy security standards and the principle of least privilege, IAM permissions must be granted using fine-grained predefined roles scoped to the specific target resources. The Artifact Registry Writer role grants permission to push images to the app-repo repository without allowing administrative changes to the registry instance. The Kubernetes Engine Developer role allows creating and updating Kubernetes workloads in the project's GKE cluster without granting cluster creation or node modification permissions.

Step-by-Step Solution

1
Identify the minimum required permissions for pushing container images.
The Artifact Registry Writer role (roles/artifactregistry.writer) allows pushing and pulling images on the target repository.
Granting access at the repository resource level respects resource scoping and least privilege.
2
Identify the minimum required permissions for managing Kubernetes deployments.
The Kubernetes Engine Developer role (roles/container.developer) provides full access to manage workloads, pods, and deployments inside GKE clusters.
This predefined role avoids broad administrative privileges provided by Kubernetes Engine Admin or primitive roles.
3
Select the correct combination of resource-scoped predefined roles.
Assigning Artifact Registry Writer on the specific repository and Kubernetes Engine Developer at the project scope fulfills all requirements securely.
This prevents over-privileging and avoids inheriting elevated permissions across unrelated projects in the resource hierarchy.

Key Concept

Applying the Principle of Least Privilege using Predefined IAM Roles and Specific Resource Scopes
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic