Examkin

Question

Difficulty: HardManaging Cloud Projects and Resource Hierarchy

A Cloud Operations Engineer needs to relocate an existing workload project from a folder named 'Staging-Folder' to a folder named 'Production-Folder' within their Google Cloud resource hierarchy. The engineer already holds the Project Editor role (`roles/editor`) on the project being moved. However, running the command `gcloud beta resource-manager projects move` results in a permission denied error. Which IAM role configuration must be granted to the engineer on the resource hierarchy to allow this project relocation?

  1. Grant the Project Mover role (`roles/resourcemanager.projectMover`) on both the source folder ('Staging-Folder') and the destination folder ('Production-Folder').Answer
  2. B
    Grant the Organization Administrator role (`roles/resourcemanager.organizationAdmin`) directly on the project being relocated.
  3. C
    Grant the Project Creator role (`roles/resourcemanager.projectCreator`) exclusively on the target 'Production-Folder'.
  4. D
    Grant the Project Owner role (`roles/owner`) on the root Organization node only.

Answer

Grant the Project Mover role (`roles/resourcemanager.projectMover`) on both the source folder ('Staging-Folder') and the destination folder ('Production-Folder').
To move a project between folders in the Google Cloud resource hierarchy, a user requires permissions to detach the project from the current parent folder and attach it to the new parent folder. The predefined role `roles/resourcemanager.projectMover` provides these required capabilities when granted on both the source and target folder nodes.

Step-by-Step Solution

1
Identify the administrative operations required during a project move in Google Cloud.
Relocating a project requires detaching it from its current parent node and attaching it to a new parent node.
Permissions on the project itself (such as Project Editor) only permit updates to the project internal configuration, not its structural placement.
2
Evaluate the mandatory Resource Manager IAM roles required on parent containers.
The principal performing the move must have project detachment rights on the source container and project attachment rights on the destination container.
The predefined role `roles/resourcemanager.projectMover` encapsulates `resourcemanager.projects.update` and `resourcemanager.projects.move` capabilities.
3
Apply the principle of least privilege across both parent hierarchy nodes.
Assigning `roles/resourcemanager.projectMover` on both the source folder and target folder satisfies the security requirement without over-granting administrative access.
Assigning permissions only on the destination or using broad primitive roles at the organization level either fails operationally or violates security best practices.

Key Concept

Moving projects between resource hierarchy folders requires Project Mover permissions on both source and destination parent containers.
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic