Examkin

Question

Difficulty: Very hardManaging IAM Roles and Resource Access Permissions

An enterprise organization manages data across multiple Google Cloud projects. A data engineer needs to run automated BigQuery jobs in Project B (`analytics-prod`) that extract log files from a specific Cloud Storage bucket in Project A (`logs-archive`) and write the processed results into a dataset in Project B. The engineer must also be able to execute query jobs in Project B, but must not be granted permissions to modify bucket configurations in Project A or alter IAM access controls in either project. Which IAM role assignment strategy follows Google's recommended security practices and strictly adheres to the principle of least privilege?

  1. Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.Answer
  2. B
    Grant `roles/editor` at the project level for both Project A and Project B.
  3. C
    Grant `roles/storage.admin` at the Project A level and `roles/bigquery.admin` at the Project B level, and attach an IAM Deny policy on the bucket in Project A to block object deletion.
  4. D
    Grant `roles/billing.admin` on the organization's billing account and `roles/bigquery.user` on Project B, relying on billing inheritance to access Cloud Storage objects in Project A.

Answer

Grant `roles/storage.objectViewer` on the specific Cloud Storage bucket in Project A, and grant `roles/bigquery.dataEditor` on the target BigQuery dataset and `roles/bigquery.jobUser` at the project level in Project B.
The optimal solution assigns predefined roles at the narrowest possible resource scope. Assigning `roles/storage.objectViewer` on the specific bucket grants read-only access to objects in Project A. Assigning `roles/bigquery.dataEditor` on the dataset in Project B allows table manipulation, while `roles/bigquery.jobUser` at the Project B level allows job execution. This combination perfectly satisfies all operational requirements while honoring the principle of least privilege.

Step-by-Step Solution

1
Analyze source storage requirements in Project A
The engineer only needs to read files from a specific Cloud Storage bucket.
Granting `roles/storage.objectViewer` at the bucket level provides read access to objects without granting project-wide storage permissions or bucket modification rights.
2
Analyze destination data writing requirements in Project B
The engineer needs to write processed data into a BigQuery dataset in Project B.
Granting `roles/bigquery.dataEditor` scoped specifically to the target dataset allows table creation and updates without exposing other datasets in the project.
3
Analyze job execution requirements in Project B
Running BigQuery queries consumes compute resources in Project B.
The `roles/bigquery.jobUser` role at the project level is required to run query jobs and allocate compute resources in Project B.

Key Concept

Least Privilege IAM Role Scoping Across Projects
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic