Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An integration engineer is configuring access for an external application service account that must send telemetry messages to a specific Google Cloud Pub/Sub topic in a production project. The application should only be capable of publishing messages to this single topic and must not be allowed to read messages, manage subscriptions, or modify any other project resources. To adhere to Google Cloud's recommendation of least privilege, which IAM configuration should be implemented?

  1. Grant the Pub/Sub Publisher role (`roles/pubsub.publisher`) to the service account directly on the target Pub/Sub topic resource.Answer
  2. B
    Grant the primitive Editor role (`roles/editor`) to the service account at the project level.
  3. C
    Grant the Pub/Sub Editor role (`roles/pubsub.editor`) to the service account at the project level.
  4. D
    Grant the Pub/Sub Viewer role (`roles/pubsub.viewer`) at the project level and rely on default topic permissions to block publishing on other topics.

Answer

Grant the Pub/Sub Publisher role (`roles/pubsub.publisher`) to the service account directly on the target Pub/Sub topic resource.
Granting the Pub/Sub Publisher role (`roles/pubsub.publisher`) directly on the target Pub/Sub topic resource enforces least privilege in two ways: it selects a fine-grained predefined role containing only publish permissions, and it scopes that permission strictly to the designated topic resource.

Step-by-Step Solution

1
Identify the specific permission required by the workload.
The application only needs `pubsub.topics.publish` to publish telemetry messages.
Least privilege requires matching permissions to the minimum necessary actions.
2
Select the appropriate predefined role over broad primitive or administrative roles.
`roles/pubsub.publisher` provides the publishing permission without granting topic creation, subscription management, or message consumption rights.
Predefined roles provide fine-grained permissions tailored to specific tasks.
3
Determine the narrowest resource scope for the role binding.
Apply the role binding on the specific topic resource rather than at the project level.
Binding roles at lower resource levels prevents granting access to other topics within the same project.

Key Concept

Applying fine-grained predefined IAM roles at the resource level to enforce least privilege.
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic