Examkin

Question

Difficulty: EasyManaging IAM Roles and Resource Access Permissions

An automated background process running outside Google Cloud needs to publish event telemetry messages to a single Cloud Pub/Sub topic in a project. Following Google Cloud security best practices and the principle of least privilege, which role assignment should be configured?

  1. Grant the Pub/Sub Publisher (roles/pubsub.publisher) role on the specific Pub/Sub topic to the service account used by the process.Answer
  2. B
    Grant the primitive Editor (roles/editor) role on the project to ensure the process can create and manage all messaging resources.
  3. C
    Grant the Pub/Sub Admin (roles/pubsub.admin) role at the project level so the process has full administrative control over messaging.
  4. D
    Deny access at the project level and grant the Pub/Sub Publisher role at the topic level to override inherited permissions.

Answer

Grant the predefined Pub/Sub Publisher (roles/pubsub.publisher) role to the service account specifically on the target Cloud Pub/Sub topic resource.
Granting the predefined Pub/Sub Publisher role on the specific topic provides exactly the permissions required to publish messages without granting unnecessary administrative access or access to other project resources.

Step-by-Step Solution

1
Identify the minimum required permissions for the workload.
The background application only requires permission to publish messages to a Pub/Sub topic.
Least privilege requires matching the identity's permissions exactly to its operational needs without extra privileges.
2
Select the appropriate IAM role type and scope.
Choose the predefined Pub/Sub Publisher role (`roles/pubsub.publisher`) rather than a primitive role or admin role, and scope it to the specific topic resource rather than the entire project.
Predefined roles offer fine-grained access, and resource-level bindings prevent unnecessary access to other topics or GCP services.

Key Concept

Principle of Least Privilege using Predefined IAM Roles at Resource Level Scope
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic