Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An automated build pipeline's service account requires access to project `proj-artifact-deploy-409`. The service account must be able to push container images to Artifact Registry repositories and update existing Cloud Run services with new container revisions. It must not be granted permissions to modify other infrastructure components or manage IAM policies. Which TWO predefined roles should be granted to the service account at the project level to adhere to the principle of least privilege? (Select TWO.)

  1. Artifact Registry Writer (roles/artifactregistry.writer)Answer
  2. Cloud Run Developer (roles/run.developer)Answer
  3. C
    Editor (roles/editor)
  4. D
    Artifact Registry Administrator (roles/artifactregistry.admin) assigned at the Organization level

Answer

To follow the principle of least privilege, grant the Artifact Registry Writer role to allow pushing container images and the Cloud Run Developer role to permit updating Cloud Run service revisions, both scoped to the specific project.
The combination of Artifact Registry Writer and Cloud Run Developer provides exactly the necessary permissions to push container images and deploy updated Cloud Run service revisions at the project scope, perfectly adhering to the principle of least privilege.

Step-by-Step Solution

1
Identify the minimum permissions required for container image management.
The Artifact Registry Writer role permits pushing and pulling container images without granting repository deletion or policy management rights.
Matching container deployment actions to specific predefined roles avoids unnecessary resource access.
2
Identify the minimum permissions required for Cloud Run application deployment.
The Cloud Run Developer role allows creating and updating service revisions while restricting broader compute administration.
Predefined workload roles isolate service management permissions.
3
Select project-scoped predefined roles over primitive or organization-wide roles.
Combining Artifact Registry Writer and Cloud Run Developer at the project resource level satisfies all functional requirements under least privilege.
Primitive roles and organization-level bindings introduce excessive security risks.

Key Concept

Applying least privilege IAM predefined roles for CI/CD container artifact management and Cloud Run service deployments.
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic