A DevOps team needs to grant a newly onboarded service account permissions to deploy and manage Cloud Run services within project `proj-staging-101`, as well as read build artifacts stored inside a specific Cloud Storage bucket named `bkt-staging-artifacts-99`. To adhere strictly to the Principle of Least Privilege without granting unnecessary permissions across other resources or projects, which TWO IAM role assignments should the team configure?
- Grant Cloud Run Developer (`roles/run.developer`) on project `proj-staging-101`.Answer
- Grant Storage Object Viewer (`roles/storage.objectViewer`) directly on the `bkt-staging-artifacts-99` bucket.Answer
- CGrant Editor (`roles/editor`) on project `proj-staging-101`.
- DGrant Storage Object Viewer (`roles/storage.objectViewer`) at the Folder level containing project `proj-staging-101`.
Answer
Assign Cloud Run Developer (roles/run.developer) at the project level and Storage Object Viewer (roles/storage.objectViewer) directly on the specific Cloud Storage bucket.
Combining the predefined Cloud Run Developer role at the project level with the Storage Object Viewer role restricted to the targeted bucket provides the exact capabilities required while avoiding excessive permissions across other services or projects.
Step-by-Step Solution
Key Concept
Applying Least Privilege using Predefined Roles and Resource-Level IAM Bindings
Estimated Time:1m 30s