Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

A security engineer is configuring access control for a log telemetry pipeline in a Google Cloud project named `telemetry-prod`. The architecture requires two distinct access configurations:

1. A developer group `[email protected]` must have full administrative control to manage Cloud Pub/Sub topics and subscriptions within `telemetry-prod`, but must not be granted permissions to modify other project resources or IAM policies.
2. An ingestion service account `[email protected]` must publish incoming log events to Cloud Pub/Sub topics within `telemetry-prod`, but must not be allowed to create, delete, or manage topic configurations.

Which TWO IAM policy bindings should you apply to fulfill these requirements while strictly adhering to the principle of least privilege?

  1. Grant `roles/pubsub.admin` to `[email protected]` on the `telemetry-prod` project.Answer
  2. Grant `roles/pubsub.publisher` to `[email protected]` on the `telemetry-prod` project.Answer
  3. C
    Grant `roles/editor` to `[email protected]` on the `telemetry-prod` project.
  4. D
    Grant `roles/pubsub.admin` to `[email protected]` on the parent Folder containing `telemetry-prod`.

Answer

Grant `roles/pubsub.admin` to the developer group at the project level, and grant `roles/pubsub.publisher` to the ingestion service account at the project level.
To satisfy least-privilege requirements for Pub/Sub administration, the predefined role `roles/pubsub.admin` provides full Pub/Sub resource management within the target project without granting permissions over other GCP services. To allow a service account to send telemetry without administrative capability, the predefined role `roles/pubsub.publisher` provides the exact publish permissions at the project scope.

Step-by-Step Solution

1
Identify the minimum predefined role required for topic and subscription administration.
The predefined role `roles/pubsub.admin` grants administrative access specifically to Cloud Pub/Sub resources without granting broad project-level permissions.
Using predefined Pub/Sub roles avoids over-granting permissions compared to broad primitive roles like Editor.
2
Identify the minimum predefined role required for publishing telemetry messages.
The predefined role `roles/pubsub.publisher` allows publishing messages to Pub/Sub topics without allowing resource modification or creation.
Service accounts should only receive the precise operational permissions needed for their functional role.
3
Determine the appropriate resource hierarchy scope for the IAM bindings.
Bind both roles at the project level (`telemetry-prod`).
Granting roles at a higher scope (such as a parent Folder or Organization) would inherit permissions to unintended child projects.

Key Concept

Principle of Least Privilege with Predefined Roles and Hierarchy Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic