Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An organization is configuring access for an automated CI/CD service account that must deploy workloads to Google Kubernetes Engine (GKE) clusters and read database passwords stored in Secret Manager within a single project named `prod-application`. In accordance with the principle of least privilege, which TWO IAM roles should be granted to the service account? (Select TWO.)

  1. Kubernetes Engine Developer (`roles/container.developer`) bound at the project levelAnswer
  2. B
    Editor (`roles/editor`) bound at the project level
  3. Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) bound at the project levelAnswer
  4. D
    Secret Manager Admin (`roles/secretmanager.admin`) bound at the parent Folder level

Answer

To follow the principle of least privilege for deploying GKE workloads and accessing Secret Manager payloads within a specific project, grant the Kubernetes Engine Developer (`roles/container.developer`) role and the Secret Manager Secret Accessor (`roles/secretmanager.secretAccessor`) role at the project level.
Adhering to the principle of least privilege requires selecting targeted predefined roles scoped directly to the affected project. The Kubernetes Engine Developer role permits deploying container workloads without cluster admin capabilities, while the Secret Manager Secret Accessor role allows reading secret data without allowing secret administration.

Step-by-Step Solution

1
Identify the minimum required permissions for managing GKE Kubernetes workloads.
Select `roles/container.developer` instead of primitive roles or cluster admin roles.
This predefined role grants permissions to create and edit application deployments, pods, and services inside GKE clusters.
2
Identify the minimum required permissions for reading secret values from Secret Manager.
Select `roles/secretmanager.secretAccessor` at the target project level.
This role permits fetching secret payloads without allowing administration or modification of secret configurations.
3
Verify resource hierarchy scoping.
Ensure bindings are restricted to the specific target project scope.
Binding roles higher up in the hierarchy (such as at the Folder or Organization level) grants unnecessary permissions across unintended projects.

Key Concept

Applying Least Privilege with Predefined Roles and Resource Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic