Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

An analytics team needs to grant access to an automated reporting tool's service account. The service account must execute SQL query jobs in the project `proj-analytics-prod` and read table data exclusively from a specific BigQuery dataset named `ds_finance`. Following the principle of least privilege, which combination of IAM role assignments should you configure?

  1. Grant `roles/bigquery.jobUser` on the project `proj-analytics-prod`, and grant `roles/bigquery.dataViewer` on the `ds_finance` dataset.Answer
  2. B
    Grant `roles/editor` on the project `proj-analytics-prod`.
  3. C
    Grant `roles/bigquery.admin` at the parent Folder level containing `proj-analytics-prod`.
  4. D
    Grant `roles/bigquery.dataViewer` on the project `proj-analytics-prod`, and grant `roles/bigquery.jobUser` on the `ds_finance` dataset.

Answer

Grant `roles/bigquery.jobUser` at the project level (`proj-analytics-prod`) and `roles/bigquery.dataViewer` at the specific dataset level (`ds_finance`).
Executing BigQuery SQL queries requires the permission to create jobs in the designated project, which is provided by the predefined role BigQuery Job User (`roles/bigquery.jobUser`) bound at the project level. To restrict data access exclusively to `ds_finance`, the BigQuery Data Viewer role (`roles/bigquery.dataViewer`) must be assigned directly on the dataset resource itself rather than the project.

Step-by-Step Solution

1
Identify the project-level requirement for query job execution.
Creating and running BigQuery jobs (queries, exports, loads) requires `bigquery.jobs.create` permission, which is granted by the `roles/bigquery.jobUser` role at the project level.
Jobs belong to the project resource scope where compute resources are consumed.
2
Identify the resource-level requirement for data access restriction.
Reading dataset contents requires `roles/bigquery.dataViewer`, which can be bound directly to the dataset `ds_finance`.
Binding read roles directly on the dataset prevents inheriting read access over other datasets in the same project.
3
Combine the permissions adhering to the Principle of Least Privilege.
The identity receives job execution rights on the billing/query project and scoped read rights only on the target dataset.
This minimizes security exposure while providing exact functional capabilities.

Key Concept

Fine-Grained BigQuery IAM Resource Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic