A security team grants an auditor the Storage Object Viewer role (`roles/storage.objectViewer`) at the Google Cloud Organization resource level. Later, a project administrator attempts to restrict this access by removing the auditor's role assignment from a specific project's IAM policy within that organization. Which outcome occurs when the auditor attempts to read an object in a Cloud Storage bucket inside that project?
- The auditor retains full access to read objects because permissions granted at higher levels in the resource hierarchy are inherited and cannot be revoked at lower levels.Answer
- BThe auditor loses access because explicitly managing project-level IAM policy bindings overrides organization-wide permission inheritance.
- CThe auditor loses access to the project's buckets unless the project administrator grants them the Viewer primitive role at the project level.
- DThe auditor is denied access because resource policies evaluated at the child project level take precedence over parent organization policies.
Answer
The auditor retains full access to read objects because permissions granted at higher levels in the resource hierarchy are inherited and cannot be revoked at lower levels.
In Google Cloud IAM, policies are evaluated as an additive union across the resource hierarchy. Roles assigned at a parent level (such as an Organization or Folder) are inherited by all child resources (such as Projects and Cloud Storage buckets). Removing a role binding at a child project level does not affect permissions granted at the Organization level.
Step-by-Step Solution
Key Concept
Resource Hierarchy IAM Policy Inheritance