Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An integration engineer must grant a third-party application service account access to publish metric events to a single Cloud Pub/Sub topic named `events-telemetry` within the GCP project `analytics-prod-88`. The application must not be granted permissions to manage Pub/Sub topics or publish messages to any other topics. Which configuration adheres to the principle of least privilege?

  1. Grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the service account directly on the `events-telemetry` topic resource.Answer
  2. B
    Grant the Editor role (roles/editor) to the service account on the `analytics-prod-88` project.
  3. C
    Grant the Pub/Sub Publisher role (roles/pubsub.publisher) to the service account at the parent Organization level.
  4. D
    Grant the Pub/Sub Admin role (roles/pubsub.admin) to the service account on the `analytics-prod-88` project.

Answer

Grant the predefined Pub/Sub Publisher role (roles/pubsub.publisher) directly on the specific topic resource.
Granting the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) directly on the target Pub/Sub topic resource enforces the principle of least privilege by scoping permissions strictly to the single topic required.

Step-by-Step Solution

1
Identify the minimum required IAM permission for the task
The application only requires message publishing capabilities on a single target Pub/Sub topic.
Following the principle of least privilege minimizes security exposure by restricting actions.
2
Select the appropriate role type and resource binding scope
Apply the predefined role `roles/pubsub.publisher` directly on the IAM policy binding for the `events-telemetry` topic.
Resource-level bindings prevent granting publishing permissions across other topics in the project or organization.

Key Concept

Applying Least Privilege with Resource-Level IAM Roles
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic