Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A software developer on your team needs to create and manage Cloud Pub/Sub topics and subscriptions within a development project. The developer must not have access to modify project IAM permissions or create resources in other Google Cloud services. Following Google Cloud's principle of least privilege, which IAM role should you grant to the developer?

  1. Pub/Sub Editor (roles/pubsub.editor)Answer
  2. B
    Editor (roles/editor)
  3. C
    Pub/Sub Admin (roles/pubsub.admin) granted at the Organization level
  4. D
    Project Billing Manager (roles/billing.projectManager)

Answer

Granting the Pub/Sub Editor (roles/pubsub.editor) role at the project level provides the required permissions to create and manage Cloud Pub/Sub topics and subscriptions while enforcing least privilege.
The Pub/Sub Editor (roles/pubsub.editor) role grants full access to create, modify, and delete Cloud Pub/Sub topics and subscriptions without granting administrative control over project IAM policies or other Google Cloud services.

Step-by-Step Solution

1
Identify the specific Google Cloud service requirements.
The developer only requires access to manage Cloud Pub/Sub topics and subscriptions.
Permissions should be restricted specifically to the target service and actions.
2
Evaluate role types for least-privilege enforcement.
Select a predefined role specifically tailored to Cloud Pub/Sub.
Primitive roles like Editor grant excessive privileges across nearly all project services.
3
Select the correct resource binding level.
Bind the role at the specific project level.
Granting roles higher up in the resource hierarchy (such as Folder or Organization level) causes unwanted permission inheritance across all child projects.

Key Concept

Applying Least Privilege with Predefined Roles
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic