Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A DevOps engineer needs to grant a third-party monitoring service account access to inspect Cloud Pub/Sub topic and subscription configurations within project `proj-telemetry-prod`. The service account must not be granted permissions to publish or acknowledge message content, nor should it have access to unrelated resources in the project. Which IAM role assignment adheres to the principle of least privilege?

  1. Grant the Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role on project `proj-telemetry-prod`.Answer
  2. B
    Grant the Viewer (`roles/viewer`) primitive role on project `proj-telemetry-prod`.
  3. C
    Grant the Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role at the Organization level.
  4. D
    Grant the Editor (`roles/editor`) primitive role on project `proj-telemetry-prod`.

Answer

Granting the Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role on project `proj-telemetry-prod` adheres to the principle of least privilege by scope-limiting access to the target project and granting only necessary resource metadata read permissions.
The Cloud Pub/Sub Viewer (`roles/pubsub.viewer`) role provides permissions to inspect topics and subscriptions without allowing message data payload access or permissions on other GCP services, perfectly matching the project-scoped least-privilege requirement.

Step-by-Step Solution

1
Identify the required permissions and target resources
The requirement asks for viewing Pub/Sub topic and subscription metadata without message data access or broader resource access.
Adhering to least privilege requires selecting a specific predefined role over general primitive roles.
2
Evaluate role granularity
The predefined role `roles/pubsub.viewer` permits inspecting Pub/Sub resources without message publishing or consumption rights.
Primitive roles like Viewer (`roles/viewer`) or Editor (`roles/editor`) grant broad access to all project resources.
3
Evaluate resource hierarchy binding scope
Binding the role at the project level (`proj-telemetry-prod`) limits access strictly to the requested project.
Binding at the organization level causes broad inheritance across all projects in the hierarchy.

Key Concept

Principle of Least Privilege and Resource Hierarchy Scope in IAM
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic