Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

A newly hired database administrator needs read-only access to view Cloud SQL instance configuration details within a single project named `db-dev-app`. The administrator does not require access to read database table contents or modify any resources. Adhering to the principle of least privilege, which IAM role assignment should you select?

  1. Grant the Cloud SQL Viewer role (`roles/cloudsql.viewer`) on the `db-dev-app` project.Answer
  2. B
    Grant the primitive Viewer role (`roles/viewer`) on the `db-dev-app` project.
  3. C
    Grant the Cloud SQL Admin role (`roles/cloudsql.admin`) on the `db-dev-app` project.
  4. D
    Grant the Cloud SQL Viewer role (`roles/cloudsql.viewer`) at the parent Folder level containing the project.

Answer

Grant the Cloud SQL Viewer role (`roles/cloudsql.viewer`) on the `db-dev-app` project.
Granting the predefined `roles/cloudsql.viewer` role directly on the target project (`db-dev-app`) provides the exact read-only access necessary for Cloud SQL resources without granting permissions to other services or other projects.

Step-by-Step Solution

1
Identify the specific GCP service and required permission level.
The target workload requires inspecting Cloud SQL instance configurations without administrative rights or broader service access.
Least privilege mandates giving only the specific role required for the task.
2
Select between Primitive and Predefined roles.
Choose `roles/cloudsql.viewer` over broad primitive roles like `roles/viewer` or overly permissive administrative roles like `roles/cloudsql.admin`.
Predefined roles limit scope strictly to Cloud SQL resources.
3
Determine the minimal resource hierarchy scope.
Bind the role directly at the `db-dev-app` project level rather than a parent folder or organization level.
Scope inheritance would grant access across unintended sibling projects if bound higher up the resource hierarchy.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in IAM
Estimated Time:45s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic