Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

A security engineer needs to configure access for an application service account running in a dedicated project named `finance-prod-app`. The service account requires access to retrieve and read secret values stored within Secret Manager in this project. To comply with corporate security standards, the service account must not have access to secrets in any other project within the organization, nor should it have permissions to create, update, or delete secret metadata. Which IAM role binding strategy adheres to the principle of least privilege while meeting these requirements?

  1. Grant the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the service account on the finance-prod-app project.Answer
  2. B
    Grant the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the service account on the parent Folder containing the finance-prod-app project.
  3. C
    Grant the Primitive Editor role (roles/editor) to the service account on the finance-prod-app project.
  4. D
    Grant the Primitive Viewer role (roles/viewer) to the service account on the Organization resource.

Answer

Granting the predefined Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) at the specific project resource scope (finance-prod-app) adheres strictly to the principle of least privilege.
The predefined role 'roles/secretmanager.secretAccessor' specifically grants the permission 'secretmanager.versions.access' required to read secret payloads. Binding this role at the project level restricts access to secrets within that project alone, fulfilling both operational and security requirements under the principle of least privilege.

Step-by-Step Solution

1
Identify the specific permission requirements
The workload requires reading secret payload data (secret accessor rights) without modification or administrative permissions.
Understanding exact access requirements prevents over-privileging.
2
Select the appropriate IAM role type
Choose the predefined role 'roles/secretmanager.secretAccessor' over primitive roles like Editor or Viewer.
Predefined roles contain tailored permission sets specific to the required operations.
3
Determine the correct resource hierarchy scope
Bind the role at the target Project level ('finance-prod-app') rather than at the Folder or Organization level.
IAM bindings propagate downward through inheritance; scope must be limited to the lowest level required by the workload.

Key Concept

Managing IAM Roles and Permissions - Least Privilege Scope and Predefined Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic