Examkin

Question

Difficulty: MediumManaging Cloud Projects and Resource Hierarchy

A company's cloud operations team is configuring access control within their Google Cloud resource hierarchy. The hierarchy contains an Organization node with top-level folders for different business units, including a folder named Retail Operations. The team needs to allow a lead developer to create new projects inside the Retail Operations folder only, while preventing them from creating projects in other folders or managing folder policies. Which IAM role configuration meets these requirements while adhering to the principle of least privilege?

  1. Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.Answer
  2. B
    Grant the Owner role (roles/owner) to the lead developer on the Organization node.
  3. C
    Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Organization node.
  4. D
    Grant the Folder Admin role (roles/resourcemanager.folderAdmin) to the lead developer on the Retail Operations folder node.

Answer

Grant the Project Creator role (roles/resourcemanager.projectCreator) to the lead developer on the Retail Operations folder node.
Assigning the Project Creator predefined role (roles/resourcemanager.projectCreator) specifically on the Retail Operations folder node grants the required permission to provision projects under that folder. Because IAM policies inherit downwards in the Google Cloud resource hierarchy, binding the role at the folder level ensures the developer cannot create projects in sibling or parent nodes, adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the specific task required.
The user needs to create new Google Cloud projects.
Selecting the predefined role specifically designed for project creation requires the Project Creator role (roles/resourcemanager.projectCreator).
2
Determine the correct resource hierarchy level for scoping access.
Scope the IAM binding to the Retail Operations folder node.
In GCP resource hierarchy (Organization > Folder > Project > Resource), IAM policies inherit downward. Scoping the binding to the target folder limits project creation rights strictly to that folder.
3
Evaluate against the principle of least privilege.
The configuration grants only project creation within the designated folder.
Avoid broad primitive roles (Owner) or higher-level administrative roles (Folder Admin, Organization Admin) to prevent over-privileging.

Key Concept

Resource Hierarchy IAM Policy Scoping and Inheritance
Estimated Time:1m 30s
Rate this question

Topics

Managing Cloud Projects and Resource Hierarchy

More questions from this topic