Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

A software developer requires permission to view and read objects within Cloud Storage buckets in a specific Google Cloud project, but must not be able to create, modify, or delete objects. Which IAM role should be assigned to the developer to enforce the principle of least privilege?

  1. Storage Object Viewer (roles/storage.objectViewer)Answer
  2. B
    Editor (roles/editor)
  3. C
    Storage Admin (roles/storage.admin)
  4. D
    Project Viewer (roles/viewer) at the project level combined with a bucket deny policy

Answer

Assign the predefined Storage Object Viewer (roles/storage.objectViewer) role.
The Storage Object Viewer role (roles/storage.objectViewer) provides read access to Cloud Storage objects without granting rights to create, edit, delete objects, or manage bucket policies. This satisfies the requirement while following the principle of least privilege.

Step-by-Step Solution

1
Identify the precise access requirements
The developer only needs to view and read objects within Cloud Storage.
The requirement explicitly restricts creating, modifying, or deleting objects.
2
Select the predefined role matching least privilege
The Storage Object Viewer (roles/storage.objectViewer) role provides exact read-only access to objects.
Google Cloud best practice dictates using specific predefined roles over broad primitive roles or administrative permissions.

Key Concept

Granting minimal necessary access using predefined Cloud Storage IAM roles.
Estimated Time:45s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic