Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A software developer needs to inspect the configuration parameters and operational status of Cloud Run services within a Google Cloud project named `prod-services` to troubleshoot performance issues. The developer must not be allowed to deploy new services, modify existing configurations, or view underlying source code and secrets. Following Google Cloud recommended security practices and the principle of least privilege, which IAM role assignment should you grant to the developer?

  1. Grant the `roles/run.viewer` role to the developer at the `prod-services` project level.Answer
  2. B
    Grant the `roles/viewer` role to the developer at the `prod-services` project level.
  3. C
    Grant the `roles/run.viewer` role to the developer at the Organization level and revoke access at the project level.
  4. D
    Grant the `roles/editor` role to the developer at the `prod-services` project level.

Answer

Granting the predefined role `roles/run.viewer` at the `prod-services` project level provides read-only access to Cloud Run resources without granting excessive permissions on other project resources.
Assigning the predefined role `roles/run.viewer` at the `prod-services` project level specifically limits the developer's permissions to viewing Cloud Run resources, fulfilling the task requirements while strictly honoring the principle of least privilege.

Step-by-Step Solution

1
Identify required resource permissions
The requirement specifies read-only inspection of Cloud Run services in the `prod-services` project.
Under the principle of least privilege, access should be restricted only to the specific service and action needed.
2
Evaluate role types (Primitive vs. Predefined)
Select the predefined role `roles/run.viewer` instead of primitive roles like `roles/viewer` or `roles/editor`.
Primitive roles grant broad project-wide permissions across all services, whereas predefined service roles grant targeted permissions.
3
Select the correct resource hierarchy scope
Bind the role directly to the user at the `prod-services` project level.
Granting permissions at the Organization level would propagate access to all projects across the enterprise because IAM policy inheritance is strictly additive.

Key Concept

Principle of Least Privilege and Predefined Roles in GCP IAM
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic