Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

A lead security engineer is configuring access controls for an internal compliance service that needs to retrieve sensitive API tokens stored in Secret Manager within a specific project named `corp-sec-vault`. The service executes under a dedicated service account named `[email protected]`. The compliance service does not require administrative capabilities, such as creating, updating, or deleting secret metadata. To adhere strictly to Google Cloud security best practices and the principle of least privilege, which IAM configuration should the security engineer apply?

  1. Grant the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the service account at the `corp-sec-vault` project level.Answer
  2. B
    Grant the Editor role (roles/editor) to the service account at the `corp-sec-vault` project level.
  3. C
    Grant the Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the service account at the parent Folder level.
  4. D
    Grant the Owner role (roles/owner) to the service account at the `corp-sec-vault` project level.

Answer

Grant the predefined role Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) to the service account scoped specifically to the target project.
Granting the predefined Secret Manager Secret Accessor role at the project level restricts the service account to only reading secret payloads inside the target project. This satisfies the requirement without exposing administrative controls or granting access to other projects in the resource hierarchy.

Step-by-Step Solution

1
Identify the specific task requirements and required permission scope
The application only needs to read secret payloads within project `corp-sec-vault` without needing administrative privileges or access to other projects.
Security best practices dictate selecting predefined roles with only necessary permissions over broad primitive roles.
2
Evaluate role types against the principle of least privilege
The predefined Secret Manager Secret Accessor role provides access to secret contents while excluding management operations and non-related GCP service access.
Primitive roles like Editor or Owner grant expansive privileges across the entire project.
3
Select the appropriate resource hierarchy scope for the binding
Binding the role at the project level ensures the service account gains access only within `corp-sec-vault` and not across parent folders or other organizational resources.
IAM permissions assigned at higher levels of the hierarchy inherit downward to all child resources.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in GCP IAM
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic