Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

An organization needs to configure IAM permissions for an automated monitoring service account. The service account must be able to read log entries in Cloud Logging for a specific project and upload generated report files into a designated Cloud Storage bucket, without being able to read or modify existing files in that bucket. Adhering strictly to Google Cloud's principle of least privilege, which TWO role assignments should be granted? (Select TWO.)

  1. Grant the Logs Viewer role (roles/logging.viewer) to the service account at the project level.Answer
  2. Grant the Storage Object Creator role (roles/storage.objectCreator) to the service account on the specific Cloud Storage bucket.Answer
  3. C
    Grant the Editor role (roles/editor) to the service account at the project level.
  4. D
    Grant the Storage Admin role (roles/storage.admin) to the service account at the organization level and apply a project-level policy to revoke delete permissions.

Answer

Granting the Logs Viewer role (roles/logging.viewer) at the project level and the Storage Object Creator role (roles/storage.objectCreator) on the target Cloud Storage bucket.
To fulfill the principle of least privilege, specific predefined roles should be assigned at the narrowest appropriate resource level. Assigning the Logs Viewer role (roles/logging.viewer) at the project level grants read access to log entries without broader management rights. Assigning the Storage Object Creator role (roles/storage.objectCreator) on the specific Cloud Storage bucket allows uploading report files without permitting object deletion or viewing existing data.

Step-by-Step Solution

1
Analyze access requirements for reading Cloud Logging logs.
The service account requires read access to project logs, which is directly satisfied by the predefined Logs Viewer role (roles/logging.viewer).
Granting roles/logging.viewer at the project level provides necessary read permissions for log entries while preventing unintended configuration changes.
2
Analyze access requirements for uploading report files to Cloud Storage.
The service account only needs to upload new files without reading or deleting existing objects.
Granting the Storage Object Creator role (roles/storage.objectCreator) directly on the target bucket resource restricts actions exclusively to creating new objects.
3
Evaluate distractor options against Google Cloud IAM best practices.
Broad primitive roles and organization-level role grants violate least privilege and hierarchy inheritance principles.
Primitive roles grant excessive privileges across project services, and inherited permissions from parent hierarchy levels cannot be restricted by downstream policies.

Key Concept

Managing least-privilege predefined IAM roles at appropriate resource hierarchy levels
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic