Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A cloud administrator needs to grant an operations engineer the ability to create, update, and delete custom IAM roles within a specific Google Cloud project. The engineer must not be granted permissions to modify project IAM access policies or manage other project resources. To adhere to the principle of least privilege, which IAM role should be granted to the engineer?

  1. Role Administrator (roles/iam.roleAdmin)Answer
  2. B
    Editor (roles/editor)
  3. C
    Security Admin (roles/iam.securityAdmin)
  4. D
    Organization Admin (roles/resourcemanager.organizationAdmin)

Answer

The Role Administrator role (roles/iam.roleAdmin) should be granted to the engineer.
The Role Administrator role (`roles/iam.roleAdmin`) grants permissions to create, update, and delete custom IAM roles (`iam.roles.create`, `iam.roles.update`, `iam.roles.delete`, `iam.roles.get`, `iam.roles.list`) without conferring permissions to modify resource IAM policies (`resourcemanager.projects.setIamPolicy`) or manage other service resources. This aligns strictly with Google Cloud best practices for least privilege access.

Step-by-Step Solution

1
Analyze the access requirement
The user needs to create, update, and delete custom IAM roles within a specific GCP project.
Identifying the minimal set of required permissions is the first step in applying least privilege.
2
Evaluate role permissions against the principle of least privilege
The predefined Role Administrator role (roles/iam.roleAdmin) contains iam.roles.* permissions necessary to manage role definitions without granting access to modify IAM policy bindings or project data.
Predefined roles are preferred over primitive roles (Owner, Editor, Viewer) or overly permissive security roles.
3
Select the optimal role
Granting Role Administrator (roles/iam.roleAdmin) fulfills the requirement with minimal necessary permissions.
This prevents unnecessary administrative elevation or access to underlying project resources.

Key Concept

Selecting predefined IAM roles based on least privilege for role management
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic