An Associate Cloud Engineer is investigating an unexpected permissions behavior within an enterprise Google Cloud environment. A developer reports that they are able to view and modify Compute Engine virtual machine instances inside a specific project named `Project-App-Prod`, despite having no direct IAM role assignments on that specific project. Which TWO configurations within the Google Cloud resource hierarchy explain how the developer obtained these permissions? (Select TWO)
- The developer was granted an IAM role containing Compute Engine permissions at an ancestor folder or organization level in the resource hierarchy.Answer
- The developer is a member of a Google Group that has been assigned an IAM role with Compute Engine permissions on a parent folder containing the project.Answer
- CThe developer was assigned the primitive Viewer role directly on `Project-App-Prod`, which implicitly escalates and overrides missing compute management privileges.
- DThe developer was assigned the Billing Account User role on the billing account linked to `Project-App-Prod`, which automatically confers administrative access over compute resources.
- EAn Organization Policy applied at the parent folder level enforces a constraint that automatically grants full resource control to all domain users.
Answer
The permissions are inherited because the developer either directly holds an IAM role on an ancestor folder/organization node, or belongs to a Google Group that holds an IAM role on an ancestor folder.
IAM permissions in Google Cloud are strictly additive and inherit downward through the resource hierarchy (Organization -> Folder -> Project -> Resource). A user acquires effective permissions on a project if an IAM role is granted to their user account or to a Google Group they belong to at any ancestor level (such as a parent folder or the organization node).
Step-by-Step Solution
Key Concept
Google Cloud IAM Policy Inheritance and Resource Hierarchy
Estimated Time:1m 30s