Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An organization requires a newly onboarded security compliance officer to inspect Cloud Key Management Service (Cloud KMS) key rings and key metadata within a target project named `sec-ops-prod`. The compliance officer must be able to view key configurations and IAM policy bindings on the keys, but must not be granted permissions to decrypt data, create new keys, or access resources in adjacent projects located under the same parent folder. Which IAM role assignment adheres to the principle of least privilege?

  1. Grant the Cloud KMS Viewer role (`roles/cloudkms.viewer`) to the compliance officer on the `sec-ops-prod` project.Answer
  2. B
    Grant the Viewer primitive role (`roles/viewer`) to the compliance officer on the parent folder containing `sec-ops-prod`.
  3. C
    Grant the Editor primitive role (`roles/editor`) to the compliance officer on the `sec-ops-prod` project.
  4. D
    Grant the Cloud KMS Admin role (`roles/cloudkms.admin`) to the compliance officer on the `sec-ops-prod` project.

Answer

Granting the Cloud KMS Viewer role (`roles/cloudkms.viewer`) to the user on the `sec-ops-prod` project provides read-only inspection of key metadata and IAM policies without decryption or key creation privileges.
Assigning the Cloud KMS Viewer role (`roles/cloudkms.viewer`) at the target project level (`sec-ops-prod`) fulfills the requirement cleanly. It permits viewing key rings, keys, and IAM policies, but explicitly excludes cryptographic operations like decryption as well as administrative privileges like key creation, adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Analyze the access scope required by the workload.
Access must be limited strictly to the `sec-ops-prod` project rather than inherited from a parent folder.
Granting roles at the parent folder level exposes all child projects under that folder due to resource hierarchy inheritance.
2
Identify required permissions for inspection versus administrative operations.
The officer needs permissions to list and get Cloud KMS metadata and IAM policies (`cloudkms.keyRings.get`, `cloudkms.cryptoKeys.getIamPolicy`), but not decryption (`cloudkms.cryptoKeyVersions.useToDecrypt`) or creation (`cloudkms.cryptoKeys.create`).
The principle of least privilege requires granting only the specific capabilities necessary to perform the job function.
3
Select the appropriate predefined IAM role over primitive or admin roles.
The predefined role `roles/cloudkms.viewer` maps directly to metadata inspection without key management or cryptographic execution permissions.
Predefined roles offer fine-grained privilege control compared to broad primitive roles (Viewer/Editor/Owner) or administrative predefined roles.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in GCP IAM
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic