Examkin

Question

Difficulty: HardManaging IAM Roles and Resource Access Permissions

An enterprise organization uses Google Cloud resource hierarchy to manage access control. A cloud engineer is granted the Storage Admin role (roles/storage.admin) at a parent folder level containing multiple projects. A security administrator attempts to restrict this engineer's privileges on a specific sensitive Cloud Storage bucket located inside one of those child projects by granting the engineer the Storage Object Viewer role (roles/storage.objectViewer) directly on that individual bucket resource. What is the engineer's effective access level on the sensitive Cloud Storage bucket?

  1. Full administrative control over the bucket, because IAM policy inheritance is strictly additive down the resource hierarchy and lower-level role assignments cannot revoke or restrict inherited permissions.Answer
  2. B
    Read-only access to the bucket objects, because resource-level IAM bindings take precedence over parent folder-level bindings.
  3. C
    No access to the bucket, because assigning explicit conflicting roles at different hierarchy levels invalidates access until resolved by an organization policy.
  4. D
    Editor-level access on the bucket, because Google Cloud automatically averages folder-level administrative roles with resource-level viewer roles into the Editor primitive role.

Answer

The engineer retains full administrative control over the bucket because IAM permissions are unionized (additive) down the Google Cloud resource hierarchy.
In Google Cloud IAM, policy inheritance across the resource hierarchy (Organization > Folder > Project > Resource) is strictly additive. An identity receives the effective permissions of all roles granted at every level above the resource plus any roles granted directly on the resource itself. Because permissions cannot be revoked or overridden at lower levels using standard role bindings, the inherited Storage Admin role remains fully active on the bucket.

Step-by-Step Solution

1
Evaluate permission inheritance down the resource hierarchy.
Permissions granted at the folder level (roles/storage.admin) flow down to all child projects and child resources, including Cloud Storage buckets within those projects.
Google Cloud IAM follows a strict inheritance model where child resources inherit all permissions granted on parent nodes.
2
Evaluate the effect of adding a lower-level role assignment.
Assigning roles/storage.objectViewer on the bucket adds read permissions to the identity's policy union, but does not remove or restrict the storage.admin permissions inherited from the folder.
IAM policies are additive; there is no explicit deny mechanism built into standard role assignments that allows a narrower role at a lower level to override an inherited broader role.
3
Determine the effective permission set.
Effective permissions on the bucket equal the union of inherited folder permissions and resource permissions, granting full administrative access.
Effective access is calculated as the logical OR of all permissions granted across all levels of the resource hierarchy.

Key Concept

IAM Resource Hierarchy Policy Inheritance and Additive Permission Model
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic