Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An enterprise security auditor requires read-only access to inspect the configuration and operational status of Google Kubernetes Engine (GKE) clusters within a Google Cloud project. The auditor must not have permission to modify cluster settings, delete nodes, or deploy workloads. Following Google's recommended security best practices for least privilege, which IAM role should be assigned to the auditor?

  1. Kubernetes Engine Viewer (roles/container.viewer)Answer
  2. B
    Project Viewer (roles/viewer)
  3. C
    Kubernetes Engine Developer (roles/container.developer)
  4. D
    Kubernetes Engine Cluster Admin (roles/container.clusterAdmin)

Answer

Kubernetes Engine Viewer (roles/container.viewer)
The Kubernetes Engine Viewer role (roles/container.viewer) grants read-only permissions to view GKE clusters, workloads, and related resources without enabling any modification, creation, or deletion capabilities. This aligns strictly with the principle of least privilege.

Step-by-Step Solution

1
Analyze the access requirement
The target user requires read-only access to GKE cluster configurations and status without modification rights.
Security auditing requires inspection capabilities without operational control.
2
Evaluate role options against the Principle of Least Privilege
Primitive roles like Project Viewer grant overly broad access across unrelated GCP services. Service-specific administrative or developer roles grant write access to resources.
Google Cloud IAM best practices dictate assigning predefined roles restricted specifically to the target service and requested access level.
3
Select the specific predefined role
Kubernetes Engine Viewer (roles/container.viewer) provides read-only access to GKE resources.
It fulfills the exact requirements without granting excess permissions or broad project-wide visibility.

Key Concept

Selecting service-specific predefined IAM roles over primitive roles to satisfy least privilege
Estimated Time:1m 15s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic