Examkin

Question

Difficulty: MediumEnabling and Managing Cloud Service APIs

A cloud engineer is configuring a dedicated deployment service account that will automate project setup. The service account needs to enable and disable Google Cloud APIs (such as Compute Engine API and Cloud Run API) within a targeted project named `app-deploy-prod`. Following Google Cloud best practices for the principle of least privilege, which predefined IAM role should be assigned to the service account on the `app-deploy-prod` project?

  1. Service Usage Admin (roles/serviceusage.serviceUsageAdmin)Answer
  2. B
    Editor (roles/editor)
  3. C
    Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)
  4. D
    Organization Admin (roles/resourcemanager.organizationAdmin)

Answer

Service Usage Admin (roles/serviceusage.serviceUsageAdmin)
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role grants full administrative access to enable, disable, inspect, and audit service usage and APIs within a target project while upholding the principle of least privilege.

Step-by-Step Solution

1
Identify the required functional capability
The requirement asks for enabling and disabling Cloud Service APIs within a target project.
API administration requires specific `serviceusage.services.enable` and `serviceusage.services.disable` permissions.
2
Evaluate candidate IAM roles against the Principle of Least Privilege
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) contains the exact permissions needed to enable and disable service APIs without granting broader resource modification capabilities.
Primitive roles like Editor or high-level resource manager roles like Organization Admin grant excessive permissions.

Key Concept

Enabling Cloud Service APIs using Predefined IAM Roles and Least Privilege
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic