Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An organization is onboarding a database administrator who is responsible for creating, modifying, and managing Cloud Spanner instances and databases within a specific development Google Cloud project. The administrator must not be granted permissions to manage IAM access policies or administer other unrelated cloud services in the project. Following the principle of least privilege, which IAM role should you grant to the administrator at the project level?

  1. Cloud Spanner Admin (roles/spanner.admin)Answer
  2. B
    Editor (roles/editor)
  3. C
    Owner (roles/owner)
  4. D
    Cloud Spanner Admin (roles/spanner.admin) at the parent Folder level

Answer

Grant the Cloud Spanner Admin (roles/spanner.admin) predefined role at the project level.
The Cloud Spanner Admin (roles/spanner.admin) predefined role provides complete access to manage Cloud Spanner instances and databases while strictly adhering to the principle of least privilege. Bound at the project level, it grants only the necessary privileges required for Cloud Spanner operations without opening permissions to other GCP services or allowing IAM policy modifications.

Step-by-Step Solution

1
Identify the required permissions for managing Cloud Spanner instances and databases.
Full administrative control over Cloud Spanner instances, databases, and backups is required.
The database administrator needs administrative access specifically to Cloud Spanner resources.
2
Apply the Principle of Least Privilege by selecting a specific predefined role instead of a primitive role.
Select roles/spanner.admin over primitive roles like Editor or Owner.
Predefined roles limit capabilities strictly to the relevant service features without exposing unrelated Google Cloud resources or IAM policy controls.
3
Determine the minimal resource hierarchy scope required.
Bind the role directly to the user at the specific project level.
Assigning the role at a higher folder or organization level would grant unnecessary administrative access across all projects within that folder due to IAM policy inheritance.

Key Concept

Principle of Least Privilege and Role Scoping in GCP IAM
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic