Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A cloud engineer needs to add a new role binding for a service account in a Google Cloud project by modifying the project's IAM policy via the gcloud CLI using a local policy file. Place the operational steps in the correct sequence to complete this procedure.

  1. 1Export the current project IAM policy to a local JSON file using `gcloud projects get-iam-policy PROJECT_ID --format=json > policy.json`.
  2. 2Edit `policy.json` to include the new role and member binding within the `bindings` array.
  3. 3Apply the modified policy file back to the project using `gcloud projects set-iam-policy PROJECT_ID policy.json`.
  4. 4Verify the updated permissions by running `gcloud projects get-iam-policy PROJECT_ID` or testing the service account access.

Answer

The correct sequence is: Export the existing policy to a local file, edit the local file with the new binding, apply the updated policy back to the project, and verify the changes.
Updating an IAM policy via local files follows a get-edit-set pattern. Exporting the policy first prevents dropping existing access controls, editing adds the new access, setting the policy updates GCP, and verification confirms success.

Step-by-Step Solution

1
Export the current project IAM policy
A local file named `policy.json` containing current bindings is generated.
You must obtain the existing policy structure first to avoid overwriting or dropping existing bindings.
2
Modify the local policy file
The `policy.json` file now contains the newly required role and principal target.
Editing the file locally allows precise changes to the JSON structure before committing policy updates.
3
Set the updated project IAM policy
The project IAM policy in GCP is replaced with the contents of `policy.json`.
The command `gcloud projects set-iam-policy` updates the remote resource hierarchy access rules.
4
Verify the policy modification
Confirmation that the new role binding is active.
Post-deployment audit verifies that the desired least-privilege binding is present.

Key Concept

IAM policy update workflow via declarative gcloud files
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic