A cloud engineer needs to grant a user permissions to inspect the configuration and operational status of Compute Engine virtual machine instances within a specific Google Cloud project. The user should not be granted any capabilities to modify, start, stop, or delete instances, nor read access to other project services. Following Google Cloud recommended security best practices for least privilege access control, which IAM role should be assigned to the user?
- Compute Viewer (roles/compute.viewer)Answer
- BProject Viewer (roles/viewer)
- CCompute Admin (roles/compute.admin)
- DProject Editor (roles/editor)
Answer
Compute Viewer (roles/compute.viewer)
The Compute Viewer role (roles/compute.viewer) is a predefined role that grants read-only access to Compute Engine resources. It allows the user to view instance configurations and status without permitting modifications, instance state changes, or access to other services in the project, adhering strictly to the principle of least privilege.
Step-by-Step Solution
Key Concept
Principle of Least Privilege using Predefined IAM Roles