Examkin

Question

Difficulty: MediumManaging IAM Roles and Permissions

An application developer needs to access and retrieve configuration secrets stored in Google Cloud Secret Manager for a single project named `prod-config-service`. The developer should be able to read secret values and list secret versions, but must not be allowed to modify secret payloads, delete secret versions, or alter IAM access policies. Additionally, enterprise security policy requires following the principle of least privilege and avoiding unnecessary access across the resource hierarchy. Which IAM role assignment strategy should be implemented?

  1. Grant the predefined Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the developer on the prod-config-service project.Answer
  2. B
    Grant the primitive Viewer role (roles/viewer) to the developer on the prod-config-service project.
  3. C
    Grant the predefined Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the developer at the parent Folder level containing the project.
  4. D
    Grant the primitive Editor role (roles/editor) to the developer at the Organization level.

Answer

Grant the predefined Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) to the developer on the prod-config-service project.
The Secret Manager Secret Accessor role (roles/secretmanager.secretAccessor) provides read access to secret payloads and secret version metadata. Binding this predefined role specifically at the project resource level fulfills the developer's operational need while adhering strictly to the principle of least privilege.

Step-by-Step Solution

1
Identify the required service-specific permissions.
The developer requires permission to view secret contents and list versions (secretmanager.versions.access).
The developer only needs read/access rights for secrets, not creation, modification, or IAM management capabilities.
2
Select a role adhering to the principle of least privilege.
The predefined role roles/secretmanager.secretAccessor provides exact permissions for secret payload retrieval without granting unnecessary project-wide access.
Predefined roles target specific service operations, whereas primitive roles (Owner, Editor, Viewer) grant broad permissions across all GCP resources.
3
Determine the minimal appropriate scope in the GCP resource hierarchy.
Bind the role directly on the target project (prod-config-service).
Granting roles at higher hierarchy levels (Folder or Organization) propagates permissions via inheritance to all resources under those levels.

Key Concept

Applying least-privilege predefined IAM roles at the specific project scope
Rate this question

Topics

Managing IAM Roles and Permissions

More questions from this topic