Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

An enterprise operations team is structuring their Google Cloud resource hierarchy. They created a designated Folder named `Staging-Environment` for testing workloads. You need to allow the software engineering group to create new GCP projects within the `Staging-Environment` Folder only, without giving them project creation permissions across the rest of the Organization. Which administration action follows Google Cloud recommended best practices and the principle of least privilege?

  1. Grant the Project Creator role (`roles/resourcemanager.projectCreator`) to the software engineering group bound specifically at the `Staging-Environment` Folder level.Answer
  2. B
    Grant the Owner primitive role (`roles/owner`) to the software engineering group at the `Staging-Environment` Folder level.
  3. C
    Grant the Project Creator role (`roles/resourcemanager.projectCreator`) at the Organization root level and attach an IAM Deny policy at all other folder levels.
  4. D
    Grant the Billing Account User role (`roles/billing.user`) on the parent Billing Account without granting any Resource Manager roles on the folder.

Answer

Grant the Project Creator role (`roles/resourcemanager.projectCreator`) to the software engineering group bound specifically at the `Staging-Environment` Folder level.
Granting `roles/resourcemanager.projectCreator` at the target Folder level explicitly enables users to provision projects inside that specific container, adhering to the principle of least privilege while utilizing resource hierarchy inheritance appropriately.

Step-by-Step Solution

1
Identify the required administrative capability.
The requirement calls for creating new GCP projects within a specific container in the resource hierarchy.
The predefined role `roles/resourcemanager.projectCreator` grants the `resourcemanager.projects.create` permission.
2
Determine the optimal resource hierarchy level for binding the IAM policy.
Binding the policy at the `Staging-Environment` Folder node ensures permissions automatically inherit down to projects created inside this folder only.
IAM permissions inherit down the resource hierarchy (Organization > Folder > Project > Resource). Granting permissions at the folder level limits the scope without affecting sibling folders or the Organization root.

Key Concept

Resource Hierarchy IAM Scoping and Least Privilege Project Provisioning
Estimated Time:1m 30s
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic