Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An application developer requires access to retrieve secret payloads stored in Secret Manager within project `proj-backend-services` to perform local integration testing. The security team mandates that access must adhere strictly to the Principle of Least Privilege without granting unnecessary permissions or broader hierarchy access. Which IAM role assignment should be granted to the developer?

  1. Grant the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on project `proj-backend-services`.Answer
  2. B
    Grant the Editor primitive role (`roles/editor`) on project `proj-backend-services`.
  3. C
    Grant the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) at the parent Organization level.
  4. D
    Grant the Viewer primitive role (`roles/viewer`) at the parent Folder level containing project `proj-backend-services`.

Answer

Grant the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) on project `proj-backend-services`.
The Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`) bound directly to project `proj-backend-services` provides the exact permission needed (`secretmanager.versions.access`) to read secret payloads without granting unnecessary administrative permissions or expanding access to other projects.

Step-by-Step Solution

1
Identify the target service and required capability.
The requirement is to retrieve secret payloads in Secret Manager.
Determines the specific IAM permissions required for the task.
2
Select the appropriate role type following the Principle of Least Privilege.
Choose the predefined role `roles/secretmanager.secretAccessor` instead of broad primitive roles like Owner, Editor, or Viewer.
Predefined roles provide only the minimal necessary permissions required to access secret contents.
3
Determine the narrowest required resource hierarchy binding scope.
Bind the role at the target project level (`proj-backend-services`).
Granting permissions at the project level prevents unwanted privilege escalation to other projects within the parent folder or organization.

Key Concept

Applying Least Privilege using Predefined IAM Roles at Project Scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic