Examkin

Question

Difficulty: EasyManaging IAM Roles and Permissions

An operations team needs to grant a application service account permissions to publish messages to Cloud Pub/Sub topics and manage Pub/Sub subscriptions within a dedicated staging project. The service account must not be granted full administrative control over Pub/Sub resources, nor broad access across the entire organization. Which TWO IAM roles should you grant to the service account to adhere to the principle of least privilege?

  1. Pub/Sub Publisher (roles/pubsub.publisher) on the staging projectAnswer
  2. Pub/Sub Subscriber (roles/pubsub.subscriber) on the staging projectAnswer
  3. C
    Editor (roles/editor) on the staging project
  4. D
    Pub/Sub Admin (roles/pubsub.admin) at the Organization level

Answer

To follow least privilege for messaging and subscription operations within a specific project, grant the Pub/Sub Publisher and Pub/Sub Subscriber predefined roles at the project level.
Combining the Pub/Sub Publisher and Pub/Sub Subscriber roles at the project level provides the exact permissions necessary to publish messages and create/manage subscriptions without granting unnecessary administrative permissions or broad project-wide access.

Step-by-Step Solution

1
Identify the minimal required permissions for the workload
The workload needs permissions to publish messages and manage subscriptions.
Least privilege mandates giving only necessary permissions for required tasks.
2
Select predefined roles over primitive roles or elevated administrative roles
Choose roles/pubsub.publisher and roles/pubsub.subscriber instead of roles/editor or roles/pubsub.admin.
Predefined roles limit actions specifically to publishing and subscription operations without allowing structural resource modification or broad project edits.
3
Scope the role bindings to the specific target resource level
Apply the bindings at the staging project level rather than the Organization level.
Bindings assigned at higher hierarchy levels inherit down to all child projects, granting excess access.

Key Concept

Applying Predefined IAM Roles at the Project Level under Least Privilege
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic