Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

A company requires an external compliance officer to audit security configurations in a Google Cloud project named `finance-analytics-prod`. The auditor needs to inspect IAM policy bindings across the project and view metadata configurations for Cloud Spanner instances and databases. The auditor must NOT be able to read sensitive records stored inside the Spanner database tables or alter any GCP resources. Which TWO IAM role assignments should you configure for the auditor at the project level to satisfy these requirements while adhering to the principle of least privilege?

  1. Grant the Security Reviewer role (`roles/iam.securityReviewer`) on the project.Answer
  2. Grant the Cloud Spanner Viewer role (`roles/spanner.viewer`) on the project.Answer
  3. C
    Grant the primitive Viewer role (`roles/viewer`) on the project.
  4. D
    Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the parent Organization level.

Answer

Assign the Security Reviewer role (`roles/iam.securityReviewer`) and the Cloud Spanner Viewer role (`roles/spanner.viewer`) at the project level.
To grant read-only security audit capabilities and Spanner metadata visibility under the principle of least privilege, predefined roles should be bound at the target project scope. The Security Reviewer role (`roles/iam.securityReviewer`) allows security configuration and IAM policy inspection, while the Cloud Spanner Viewer role (`roles/spanner.viewer`) grants metadata read access without permitting data row retrieval.

Step-by-Step Solution

1
Analyze the IAM requirements for auditing security policies.
Identify that inspect-only access for IAM bindings across project resources requires `roles/iam.securityReviewer`.
Security Reviewer grants security-related read permissions without providing access to actual underlying data stored in resources.
2
Analyze the IAM requirements for viewing Cloud Spanner instance and database metadata.
Identify that viewing database structure/metadata without reading table rows requires `roles/spanner.viewer`.
Cloud Spanner Viewer allows inspecting instance, database, and schema metadata while denying data plane read permissions (`spanner.databases.read`).
3
Verify scope and principle of least privilege.
Apply both predefined roles specifically at the project resource level (`finance-analytics-prod`).
Assigning predefined roles at the specific project scope avoids over-granting access via primitive roles or higher resource hierarchy levels.

Key Concept

Applying Predefined Roles at the Project Level for Least-Privilege IAM Audit Access
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic