Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

A company is configuring access for a site reliability engineer (SRE) who needs to create, modify, and delete Google Kubernetes Engine (GKE) clusters and node pools in a single Google Cloud project named `k8s-platform-prod`. The engineer must not be able to modify project IAM policies, alter billing account settings, or manage unrelated services like Cloud Storage or BigQuery. Following Google Cloud recommended security practices and the principle of least privilege, which IAM configuration should you implement?

  1. Grant the Kubernetes Engine Admin (`roles/container.admin`) role to the engineer on the `k8s-platform-prod` project.Answer
  2. B
    Grant the Kubernetes Engine Admin (`roles/container.admin`) role to the engineer on the parent Folder containing `k8s-platform-prod`.
  3. C
    Grant the primitive Editor (`roles/editor`) role to the engineer on the `k8s-platform-prod` project.
  4. D
    Grant the primitive Owner (`roles/owner`) role to the engineer on the `k8s-platform-prod` project.

Answer

Grant the predefined role Kubernetes Engine Admin (`roles/container.admin`) to the user at the specific project level (`k8s-platform-prod`).
Granting the predefined Kubernetes Engine Admin role (`roles/container.admin`) at the project level provides all necessary permissions to manage GKE clusters and node pool resources within `k8s-platform-prod` while ensuring the user cannot alter project IAM policies, modify billing account configurations, or manage non-container resources.

Step-by-Step Solution

1
Identify the required functional capabilities for the principal.
The engineer requires full management control over GKE clusters and node pools.
Understanding the specific operational scope determines the appropriate IAM role type.
2
Select a role adhering to the Principle of Least Privilege.
Choose the predefined role `roles/container.admin` over primitive roles (`roles/owner` or `roles/editor`).
Predefined roles group granular permissions tailored to specific job functions, preventing over-privileging across unrelated GCP services.
3
Determine the narrowest required scope within the GCP Resource Hierarchy.
Apply the role binding at the target project level (`k8s-platform-prod`).
Applying the role binding at the parent folder or organization level causes downstream resource hierarchy inheritance, granting unintended access across other projects.

Key Concept

Principle of Least Privilege using Predefined IAM Roles at Project Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic