Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

A DevOps team is configuring access control for an automated CI/CD deployment pipeline in a Google Cloud project named `payment-gateway-prod`. The pipeline's service account requires permissions to create and update Cloud Run service revisions, as well as read build configuration objects stored in a single specific Cloud Storage bucket named `payment-config-bucket`. Adhering strictly to the Principle of Least Privilege, which IAM role configuration should be applied?

  1. Grant `roles/run.developer` at the project level, and grant `roles/storage.objectViewer` directly on the `payment-config-bucket` bucket resource.Answer
  2. B
    Grant `roles/editor` at the project level, and grant `roles/viewer` directly on the `payment-config-bucket` bucket resource.
  3. C
    Grant `roles/run.developer` and `roles/storage.objectViewer` at the parent Folder level containing `payment-gateway-prod`.
  4. D
    Grant `roles/run.admin` at the project level, and grant `roles/storage.admin` directly on the `payment-config-bucket` bucket resource.

Answer

Granting `roles/run.developer` at the project level and `roles/storage.objectViewer` directly on the `payment-config-bucket` bucket resource provides the exact necessary permissions without granting excessive administrative privileges or expanding access to other projects.
The correct selection uses predefined roles (`roles/run.developer` and `roles/storage.objectViewer`) mapped specifically to the required operational tasks, and limits the Cloud Storage role binding directly to the specific bucket resource rather than project-wide or folder-wide.

Step-by-Step Solution

1
Identify the minimum required permissions for the Cloud Run workload requirement.
Creating and managing revisions for Cloud Run requires deployment permissions covered by the predefined role `roles/run.developer`.
Using `roles/run.developer` avoids granting administrative capabilities such as service deletion or IAM policy modifications provided by `roles/run.admin` or primitive `roles/editor`.
2
Identify the exact scope and minimum role required for the Cloud Storage access.
Reading build configuration objects requires `roles/storage.objectViewer` bound directly to the target bucket resource `payment-config-bucket`.
Resource-level IAM binding restricts object access strictly to the single required bucket rather than granting read access to all buckets across the project or folder hierarchy.
3
Evaluate resource hierarchy placement.
Permissions must be scoped at the project level for Cloud Run and at the bucket level for Cloud Storage.
Inheritance down the GCP resource hierarchy means granting roles at a higher level (like a Folder) exposes all other descendant resources to unintended access.

Key Concept

Applying Least Privilege via Predefined Roles and Resource-Level IAM Scoping
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic