Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

A cloud engineer needs to grant an external auditor access to inspect IAM policies for a specific Google Cloud project using the gcloud command-line interface. What is the correct sequence of command steps to authenticate, set the project context, assign the least-privilege predefined IAM role, and verify the assignment?

  1. 1Authenticate the gcloud CLI session by running 'gcloud auth login'.
  2. 2Set the active project context by running 'gcloud config set project PROJECT_ID'.
  3. 3Assign the predefined role by executing 'gcloud projects add-iam-policy-binding PROJECT_ID --member="user:[email protected]" --role="roles/iam.securityReviewer"'.
  4. 4Confirm the updated policy binding by executing 'gcloud projects get-iam-policy PROJECT_ID'.

Answer

The correct operational sequence begins with authenticating the session, selecting the target project configuration, applying the least-privilege IAM policy binding with gcloud projects add-iam-policy-binding, and finally inspecting the policy with gcloud projects get-iam-policy to verify access.
The workflow follows standard Google Cloud management practices: first establish user identity ('gcloud auth login'), target the appropriate resource scope ('gcloud config set project'), execute the security policy modification using least-privilege predefined roles ('gcloud projects add-iam-policy-binding'), and finally audit the change ('gcloud projects get-iam-policy').

Step-by-Step Solution

1
Authenticate session credentials.
Obtain user authorization credentials for gcloud.
CLI tools require authentication before attempting resource configuration or IAM policy mutations.
2
Set active project ID context.
Target project set in local CLI profile configuration.
Establishing project context avoids accidentally modifying permissions on the wrong Google Cloud project.
3
Add IAM policy binding with a predefined role.
The role 'roles/iam.securityReviewer' is assigned to 'user:[email protected]'.
Google Cloud best practice requires granting least-privilege predefined roles rather than basic/primitive roles like Owner or Editor.
4
Retrieve project IAM policy.
Returns the updated IAM policy bindings array.
Verifying the IAM policy ensures the binding was persisted successfully without syntax or scope errors.

Key Concept

Managing IAM Roles and Resource Access Permissions via gcloud CLI
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic