An organization is configuring access control for an external site reliability consulting team. The team requires read-only access to view metrics in Cloud Monitoring and read standard application log entries in Cloud Logging within a single Google Cloud project named `telemetry-prod-app`. According to corporate policy, the team must not have access to any other projects in the resource hierarchy, nor should they receive broad read access to unrelated GCP service resources. Which TWO IAM roles should be bound to the consulting team's group identity at the project level to satisfy these requirements while adhering to the principle of least privilege? Select TWO options.
- Monitoring Viewer (`roles/monitoring.viewer`) granted on the `telemetry-prod-app` projectAnswer
- Logs Viewer (`roles/logging.viewer`) granted on the `telemetry-prod-app` projectAnswer
- CViewer (`roles/viewer`) granted on the `telemetry-prod-app` project
- DLogs Viewer (`roles/logging.viewer`) granted at the parent Folder level containing `telemetry-prod-app`
Answer
The correct role assignments are Monitoring Viewer (`roles/monitoring.viewer`) and Logs Viewer (`roles/logging.viewer`) granted at the `telemetry-prod-app` project scope.
To satisfy least privilege for viewing metrics and standard logs in a specific project, specific predefined roles must be granted at the project scope. The Monitoring Viewer role (`roles/monitoring.viewer`) grants read-only access to Cloud Monitoring metrics and dashboards. The Logs Viewer role (`roles/logging.viewer`) grants read access to standard Cloud Logging log entries. Granting both roles directly on the target project satisfies all requirements without over-granting access.
Step-by-Step Solution
Key Concept
Applying predefined IAM roles at the project level to fulfill specific operational access requirements while enforcing least privilege and avoiding broad primitive roles or folder-level inheritance.