Examkin

Question

Difficulty: MediumEnabling and Managing Cloud Service APIs

A developer in project `media-transcoder-dev` needs to enable the Cloud Video Intelligence API for a new video processing pipeline. When executing `gcloud services enable videointelligence.googleapis.com`, the command fails with a permission denied error. The developer currently holds the Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`) role on the project. Following the principle of least privilege, which action should the cloud administrator take to resolve this issue?

  1. Grant the developer the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on `media-transcoder-dev`.Answer
  2. B
    Grant the developer the primitive Editor (`roles/editor`) role on `media-transcoder-dev`.
  3. C
    Enable the Cloud Video Intelligence API at the parent Organization level so permissions propagate down to the project.
  4. D
    Submit a resource quota increase request for the Cloud Video Intelligence API in the Google Cloud Console.

Answer

Grant the developer the Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role on project `media-transcoder-dev`.
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role grants the `serviceusage.services.enable` permission required to enable GCP service APIs without granting excessive administrative permissions over other project resources.

Step-by-Step Solution

1
Diagnose the root cause of the permission error
The user lacks the `serviceusage.services.enable` IAM permission required to enable APIs.
The developer only holds Service Usage Consumer (`roles/serviceusage.serviceUsageConsumer`), which allows using APIs that are already enabled, but not enabling new ones.
2
Identify the predefined role that grants API enablement under least privilege
Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) contains permissions to administer, enable, and disable services.
Using predefined role Service Usage Admin avoids granting unnecessary project permissions associated with broad primitive roles like Editor or Owner.
3
Assign the role at the appropriate resource scope
Grant the role on the specific project `media-transcoder-dev`.
APIs are enabled and managed on a per-project basis.

Key Concept

Enabling Cloud Service APIs requires IAM permissions provided by predefined roles such as Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) on the target project.
Estimated Time:1m 30s
Rate this question

Topics

Enabling and Managing Cloud Service APIs

More questions from this topic