Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A cloud engineer needs to grant a newly hired developer access to view Cloud Storage objects in a specific project using the gcloud CLI while following Google Cloud security best practices. What is the correct sequence of steps to configure this access?

  1. 1Identify the precise predefined role required for read-only access to storage objects (roles/storage.objectViewer).
  2. 2Identify the principal's Google Cloud identity (e.g., user email address).
  3. 3Execute the command `gcloud projects add-iam-policy-binding PROJECT_ID --member='user:[email protected]' --role='roles/storage.objectViewer'`.
  4. 4Verify the binding by inspecting the project's IAM policy using `gcloud projects get-iam-policy PROJECT_ID`.

Answer

The correct workflow follows four sequential steps: first identifying the least-privilege predefined role (`roles/storage.objectViewer`), identifying the target user identity, adding the IAM policy binding via `gcloud projects add-iam-policy-binding`, and verifying the binding using `gcloud projects get-iam-policy`.
The correct sequence begins by planning access: selecting the least-privilege predefined role (`roles/storage.objectViewer`) and establishing the user's principal identifier. Next, the administrator applies the policy change using `gcloud projects add-iam-policy-binding`. Finally, standard operational best practices dictate verifying the applied policy with `gcloud projects get-iam-policy`.

Step-by-Step Solution

1
Determine the required predefined role
Selected `roles/storage.objectViewer` instead of primitive roles like `roles/viewer` or `roles/editor` to follow least privilege.
Least privilege requires using specific predefined roles tailored to the minimal necessary permissions.
2
Identify the target user's identity
Obtained the user's principal email address formatted as `user:[email protected]`.
IAM bindings require a correctly formatted member descriptor type and identity.
3
Add the IAM policy binding via CLI
Ran `gcloud projects add-iam-policy-binding` with the target member and role.
This modifies the project IAM policy to grant the specified role to the user identity.
4
Validate permission assignment
Executed `gcloud projects get-iam-policy` to view the updated policy object.
Verification confirms that the policy binding was stored correctly without unintended scope changes.

Key Concept

Managing IAM Roles and Resource Access Permissions via gcloud CLI using least privilege principles
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic