Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A site reliability engineer needs read-only access to inspect the configuration, state, and metadata of Compute Engine Virtual Machine (VM) instances in a specific project named `proj-prod-analytics`. The engineer must not be granted permissions to modify VM configurations, start or stop instances, or access instance serial console logs. Following Google Cloud recommended security practices, which IAM role binding should you apply?

  1. Assign the Compute Viewer role (roles/compute.viewer) bound directly to the user on the proj-prod-analytics project.Answer
  2. B
    Assign the Editor role (roles/editor) bound directly to the user on the proj-prod-analytics project.
  3. C
    Assign the Compute Viewer role (roles/compute.viewer) bound to the user at the Organization node level containing proj-prod-analytics.
  4. D
    Assign the Viewer role (roles/viewer) bound directly to the user on the proj-prod-analytics project.

Answer

Assign the Compute Viewer role (`roles/compute.viewer`) on the `proj-prod-analytics` project resource.
Binding the predefined `roles/compute.viewer` role directly at the target project level provides exact read-only permissions for Compute Engine instances without granting unnecessary privileges across other Google Cloud services or other projects.

Step-by-Step Solution

1
Identify the required permissions needed for the task.
The engineer requires read-only access limited specifically to Compute Engine VM configurations and metadata.
The requirement mandates read access while prohibiting modifications, lifecycle management (start/stop), or serial console access.
2
Evaluate role granularity adhering to the Principle of Least Privilege.
Select the predefined `roles/compute.viewer` role rather than broad primitive roles (`roles/viewer` or `roles/editor`).
Predefined roles restrict permissions to a specific GCP service, preventing excessive read permissions across unrelated project services.
3
Determine the appropriate level in the resource hierarchy for the IAM policy binding.
Apply the role binding at the specific project level (`proj-prod-analytics`).
Granting permissions at higher levels (such as Organization or Folder) causes downstream IAM inheritance, granting unintended access to other projects.

Key Concept

Applying least-privilege predefined roles at the appropriate resource hierarchy level.
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic