Examkin

Question

Difficulty: EasyEnabling and Managing Cloud Service APIs

You need to allow a team of developers to enable and disable Google Cloud service APIs within a specific project. Following the principle of least privilege, you must avoid granting unnecessary administrative permissions over other project resources. Which IAM role should you grant to the developers?

  1. Service Usage Admin (roles/serviceusage.serviceUsageAdmin)Answer
  2. B
    Owner (roles/owner)
  3. C
    Quota Administrator (roles/servicemanagement.quotaAdmin)
  4. D
    Organization Administrator (roles/resourcemanager.organizationAdmin)

Answer

The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) should be assigned because it grants permissions to enable and disable Cloud APIs following least privilege.
The Service Usage Admin role (roles/serviceusage.serviceUsageAdmin) contains permissions to administer service usage, including enabling and disabling Google Cloud APIs within a project, satisfying the minimum required privileges requirement.

Step-by-Step Solution

1
Identify the specific task required
The task requires enabling and disabling Google Cloud service APIs in a project.
Understanding the precise permission needed prevents over-privileging.
2
Apply the principle of least privilege
Select a predefined role scoped specifically to Service Usage management rather than broad primitive or organization-level roles.
Predefined roles provide targeted permissions without unnecessary administrative capabilities.
3
Select the correct predefined IAM role
Choose Service Usage Admin (roles/serviceusage.serviceUsageAdmin).
This role includes serviceusage.services.enable and serviceusage.services.disable permissions.

Key Concept

IAM Roles for Enabling and Managing Cloud Service APIs
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic