Examkin

Question

Difficulty: HardEnabling and Managing Cloud Service APIs

An enterprise platform engineering team manages an automated infrastructure pipeline. The pipeline uses a custom service account to provision new Google Cloud projects. During execution, a script in the pipeline executes the command `gcloud services enable artifactregistry.googleapis.com --project=fintech-core-prod` to enable the Artifact Registry API in the target project. The execution fails with an authorization error indicating permission denied. Adhering to the Google Cloud security principle of least privilege, which action should the system administrator take to resolve this issue?

  1. Grant the pipeline service account the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the `fintech-core-prod` project.Answer
  2. B
    Grant the pipeline service account the Service Usage Consumer role (`roles/serviceusage.serviceUsageConsumer`) on the `fintech-core-prod` project.
  3. C
    Grant the pipeline service account the Editor primitive role (`roles/editor`) on the parent Organization node in the resource hierarchy.
  4. D
    Run the `gcloud services enable` command against the pipeline's host project instead of specifying the `fintech-core-prod` project.

Answer

Grant the pipeline service account the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the target project.
To enable Google Cloud APIs, an identity requires the `serviceusage.services.enable` permission on the destination project. The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides permissions to list, enable, and disable services on a project, making it the minimal predefined role necessary to meet the principle of least privilege.

Step-by-Step Solution

1
Identify the specific GCP permission required to enable APIs.
Enabling APIs using `gcloud services enable` requires the `serviceusage.services.enable` permission on the target project.
Google Cloud service enablement operates on a per-project basis via the Service Usage API.
2
Evaluate the available IAM roles for API enablement against security best practices.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) contains the required permission for enabling and disabling services without assigning excessive permissions.
Predefined roles should be preferred over primitive roles (Owner, Editor) to satisfy the principle of least privilege.
3
Select the correct resource scope for role binding.
Bind the role on the target project `fintech-core-prod`.
APIs must be activated within the workload/target project where the API endpoints will be consumed.

Key Concept

API Enablement IAM Permissions and Least Privilege
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic