Examkin

Question

Difficulty: MediumEnabling and Managing Cloud Service APIs

Your organization is initializing a new Google Cloud project named `analytics-prod-12` to deploy containerized application workloads. A Cloud Engineer needs to enable the Cloud Run API (`run.googleapis.com`) for `analytics-prod-12` using the `gcloud` CLI while strictly adhering to the principle of least privilege. Which command and IAM role grant should the engineer use to successfully enable the service API?

  1. Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.Answer
  2. B
    Grant the engineer the Project Owner role (`roles/owner`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.
  3. C
    Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on the parent Folder, and execute `gcloud services enable run.googleapis.com` without specifying a project parameter.
  4. D
    Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud quotas requests create --service=run.googleapis.com --project=analytics-prod-12`.

Answer

Grant the engineer the Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) on `analytics-prod-12`, and execute `gcloud services enable run.googleapis.com --project=analytics-prod-12`.
To enable Google Cloud service APIs in a project while following security best practices, you must assign the predefined Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`), which grants permissions to enable and disable services without granting full project ownership. The correct gcloud CLI command syntax to enable an API for a specific project is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.

Step-by-Step Solution

1
Identify the required IAM permissions for managing GCP Service APIs.
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the permissions necessary to enable, disable, and inspect APIs in a project without granting excessive administrative rights.
Adhering to the principle of least privilege requires avoiding broad primitive roles like Owner or Editor when specific predefined roles exist.
2
Determine the correct Cloud SDK (`gcloud`) command syntax for enabling an API.
The syntax is `gcloud services enable SERVICE_NAME --project=PROJECT_ID`.
Specifying the `--project` flag guarantees that the API is enabled in the intended project (`analytics-prod-12`).

Key Concept

Enabling Cloud Service APIs using least-privilege IAM roles and the gcloud CLI
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic