Examkin

Question

Difficulty: Very hardManaging IAM Roles and Permissions

A DevOps engineer is configuring a specialized service account for an automated CI/CD deployment pipeline. The pipeline must deploy new Cloud Functions (2nd gen) instances and configure Cloud Scheduler triggers strictly within a single target Google Cloud project named `proj-services-prod`. The service account must not be granted permissions beyond what is necessary to perform these tasks, nor should it acquire access to any neighboring projects. Which IAM role configuration meets these requirements while adhering to Google Cloud recommended best practices?

  1. Grant the service account the Cloud Functions Admin (roles/cloudfunctions.admin) and Cloud Scheduler Admin (roles/cloudscheduler.admin) roles on the target project proj-services-prod.Answer
  2. B
    Grant the service account the Editor (roles/editor) role on the target project proj-services-prod.
  3. C
    Grant the service account the Cloud Functions Admin (roles/cloudfunctions.admin) and Cloud Scheduler Admin (roles/cloudscheduler.admin) roles at the parent Folder level containing proj-services-prod.
  4. D
    Grant the service account the Owner (roles/owner) role at the Organization level.

Answer

Grant the service account the predefined Cloud Functions Admin (roles/cloudfunctions.admin) and Cloud Scheduler Admin (roles/cloudscheduler.admin) roles directly on the target project proj-services-prod.
Granting specific predefined roles (Cloud Functions Admin and Cloud Scheduler Admin) at the target project level grants exactly the privileges needed for pipeline execution without over-privileging the service account or leaking permissions to sibling projects.

Step-by-Step Solution

1
Analyze the operational requirements
The automated deployment pipeline needs to manage Cloud Functions and Cloud Scheduler within a single specific project.
Identifying the target services and boundary limits establishes the required scope.
2
Apply the Principle of Least Privilege by role selection
Select specific predefined roles (`roles/cloudfunctions.admin` and `roles/cloudscheduler.admin`) rather than primitive roles (`roles/editor` or `roles/owner`).
Predefined roles limit actions strictly to Cloud Functions and Cloud Scheduler resources.
3
Select the correct resource hierarchy level for policy binding
Bind the IAM policy directly at the target project level (`proj-services-prod`).
Granting roles at the Folder or Organization level would automatically inherit down to all sibling projects within that scope.

Key Concept

Applying Least Privilege using Predefined Roles and Precise Hierarchy Scoping
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic