Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An event-driven microservice deployed in Google Cloud needs to publish telemetry messages to a specific Cloud Pub/Sub topic named `device-telemetry-topic` in the project `iot-ingestion-prod`. The microservice should only be granted permissions to publish messages to this specific topic and must not be allowed to create topics, modify subscriptions, or access other resources in the project. Which access control configuration adheres to the principle of least privilege?

  1. Grant the Pub/Sub Publisher role (`roles/pubsub.publisher`) to the microservice's service account directly on the `device-telemetry-topic` resource.Answer
  2. B
    Grant the primitive Editor role (`roles/editor`) to the microservice's service account at the project level.
  3. C
    Grant the Pub/Sub Admin role (`roles/pubsub.admin`) to the microservice's service account at the parent Folder level containing the project.
  4. D
    Grant the primitive Viewer role (`roles/viewer`) to the microservice's service account at the Organization level.

Answer

Grant the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) to the microservice's service account directly on the target topic resource (`device-telemetry-topic`).
The correct approach applies the principle of least privilege by combining a specific predefined role (`roles/pubsub.publisher`) with the narrowest resource scope (the `device-telemetry-topic` topic itself). This allows message publishing while preventing access to any other resources or administrative actions.

Step-by-Step Solution

1
Identify the specific capability needed by the workload
The microservice only needs to publish messages to a single Pub/Sub topic.
Determining exact operational requirements is the first step in applying least privilege.
2
Select the appropriate IAM role type
Choose the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) over broad primitive roles (Owner, Editor, Viewer).
Predefined roles provide narrow permission sets tailored to specific task requirements.
3
Select the narrowest applicable resource scope for the binding
Bind the role at the topic resource level rather than project, folder, or organization level.
Cloud Pub/Sub supports resource-level IAM policies, preventing unnecessary access to other topics or Pub/Sub resources in the project.

Key Concept

Principle of Least Privilege with Predefined Roles and Resource-Level IAM Bindings
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic