Examkin

Question

Difficulty: HardManaging IAM Roles and Permissions

An automated deployment process requires access to upload build artifacts as new files into a specific Cloud Storage bucket named `prod-build-artifacts` located inside the project `app-deployments-prod`. According to organization security compliance, the process must adhere strictly to the Principle of Least Privilege by ensuring it cannot read existing objects, overwrite/delete files, or access any other buckets in the project or parent folder. Which IAM role assignment strategy should be configured?

  1. Grant the predefined role Storage Object Creator (roles/storage.objectCreator) on the specific prod-build-artifacts bucket resource.Answer
  2. B
    Grant the primitive role Editor (roles/editor) at the app-deployments-prod project level.
  3. C
    Grant the predefined role Storage Object Creator (roles/storage.objectCreator) at the parent Folder level containing app-deployments-prod.
  4. D
    Grant the primitive role Viewer (roles/viewer) on the prod-build-artifacts bucket resource.

Answer

Grant the predefined role Storage Object Creator (roles/storage.objectCreator) specifically on the target Cloud Storage bucket resource.
Granting `roles/storage.objectCreator` directly on the target Cloud Storage bucket grants only the necessary `storage.objects.create` permission specifically on that bucket. It prevents reading existing objects, deleting data, and accessing any other buckets in the project or folder hierarchy.

Step-by-Step Solution

1
Analyze required permissions
The requirement mandates object upload (create) capability only, prohibiting object read, list, delete, or access to other storage resources.
Security rules enforce the Principle of Least Privilege.
2
Select the appropriate IAM role type
Select predefined role `roles/storage.objectCreator` over primitive roles (`roles/editor`, `roles/viewer`).
Predefined roles provide granular, narrow permissions tailored specifically to exact operational needs.
3
Determine the resource hierarchy binding level
Bind the role directly to the bucket resource `prod-build-artifacts` rather than at the project or folder level.
Permissions inherit down the hierarchy, so binding at project or folder levels grants unauthorized access to other buckets.

Key Concept

Principle of Least Privilege and IAM Resource Hierarchy Binding
Estimated Time:2m 0s
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic