Examkin

Question

Difficulty: MediumManaging IAM Roles and Resource Access Permissions

A company's automated data pipeline application requires access to upload, update, and delete log files within a specific Google Cloud Storage bucket. The application must not be allowed to modify bucket configuration settings, alter lifecycle rules, or manage bucket IAM permissions. Following Google Cloud security best practices for least privilege, which IAM role assignment should be configured for the application's service account?

  1. Grant the Storage Object Admin role (roles/storage.objectAdmin) directly on the specific Cloud Storage bucket.Answer
  2. B
    Grant the Storage Admin role (roles/storage.admin) directly on the specific Cloud Storage bucket.
  3. C
    Grant the Editor primitive role (roles/editor) at the Google Cloud project level.
  4. D
    Grant the Storage Object Admin role (roles/storage.objectAdmin) at the project level and explicitly revoke permissions on all other buckets in the project.

Answer

Granting the Storage Object Admin role (roles/storage.objectAdmin) directly on the specific Cloud Storage bucket provides full object manipulation capabilities while restricting bucket-level metadata and policy modifications.
Granting the Storage Object Admin role directly on the target bucket aligns perfectly with the principle of least privilege. It enables full object operations (uploading, updating, deleting) inside that specific bucket, while preventing any changes to bucket configurations, lifecycle policies, or IAM settings.

Step-by-Step Solution

1
Analyze the operational requirements for the service account.
The workload requires creating, updating, and removing objects within a single bucket, but must not alter bucket settings or policies.
Identifying the required scope of permissions is essential for applying least privilege access.
2
Evaluate role granularity for Cloud Storage resources.
Storage Object Admin (roles/storage.objectAdmin) grants object read, write, and delete permissions without bucket management privileges. Storage Admin (roles/storage.admin) and Editor (roles/editor) grant excess administrative permissions.
Google Cloud predefined roles separate object data manipulation from bucket configuration administration.
3
Determine the optimal resource binding level.
Binding the role directly on the specific target bucket limits access exclusively to that bucket, rather than propagating permissions project-wide.
Assigning permissions at the resource level prevents unintended access inheritance across other project buckets.

Key Concept

Principle of Least Privilege with Predefined Roles and Resource-Level IAM Bindings
Estimated Time:1m 30s
Rate this question

Topics

Managing IAM Roles and Resource Access Permissions

More questions from this topic