Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A database compliance auditor needs to inspect table schemas and execute read-only queries against a Cloud Spanner database named `inventory-db` within the production project `retail-prod`. The auditor must not have permissions to modify data, alter schemas, or access unrelated GCP resources in the project. Adhering to the principle of least privilege, which IAM role configuration should you grant to the auditor?

  1. Grant the Cloud Spanner Database Reader role (roles/spanner.databaseReader) on the specific project or database resource.Answer
  2. B
    Grant the Primitive Viewer role (roles/viewer) at the project level.
  3. C
    Grant the Cloud Spanner Database Reader role (roles/spanner.databaseReader) at the parent Folder level containing the project.
  4. D
    Grant the Primitive Editor role (roles/editor) on the Cloud Spanner instance.

Answer

Grant the Cloud Spanner Database Reader role (roles/spanner.databaseReader) to the auditor for the specific database or project scope.
Granting the Cloud Spanner Database Reader role (roles/spanner.databaseReader) at the project or database scope adheres strictly to the principle of least privilege. It enables read access to database data and schema definitions without granting access to write data or manage other GCP resources.

Step-by-Step Solution

1
Analyze the access requirement
The auditor requires read-only permissions (schema inspection and querying) for a Cloud Spanner database without data modification rights.
Security compliance requires restricting write operations and avoiding unnecessary privileges.
2
Apply the Principle of Least Privilege
Select the predefined role `roles/spanner.databaseReader` over primitive roles (`roles/viewer` or `roles/editor`).
Predefined roles limit permissions strictly to the Cloud Spanner service, unlike primitive roles which span all services in the project.
3
Determine proper resource scope
Bind the role at the target project or database level, avoiding higher hierarchy nodes like Folders or Organizations.
IAM roles set at higher levels in the resource hierarchy inherit downward to all child resources, leading to excessive access across other projects.

Key Concept

Selecting granular predefined roles bounded to specific project resources according to the Principle of Least Privilege.
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic