An administrator needs to configure granular, least-privilege access for an auditor who requires read access to application logs in a Google Cloud project. Put the following steps in the correct logical order to safely create and assign a custom IAM role.
- 1Identify the exact granular permissions required by the auditor to view application logs.
- 2Create the custom IAM role at the project level specifying the identified permissions.
- 3Add an IAM policy binding to grant the newly created custom IAM role to the auditor's identity.
- 4Test and verify that the auditor can access the logs without having excess permissions.
Answer
The correct sequence starts with identifying the required granular permissions, followed by creating the custom IAM role at the project level, binding the role to the auditor's identity, and finally verifying that least-privilege access is functioning properly.
Following Google Cloud security best practices for custom IAM management requires establishing the least-privilege permission list first. Once the exact permissions are identified, the custom IAM role is formally created at the project level. Next, the administrator binds this custom role to the user's identity. Finally, access is verified to ensure compliance and proper functionality.
Step-by-Step Solution
Key Concept
Custom IAM Role Creation and Lifecycle Management