A cloud administrator needs to grant a development team access to view Pub/Sub topic details and inspect Cloud Monitoring metrics within a single Google Cloud project named `pubsub-prod-data`. The team must not have permission to publish messages, modify resources, or access other projects within the parent folder. To comply with the principle of least privilege, which TWO IAM role assignments should you configure? (Select TWO.)
- Assign the Pub/Sub Viewer (`roles/pubsub.viewer`) role to the development group on the `pubsub-prod-data` project.Answer
- Assign the Monitoring Viewer (`roles/monitoring.viewer`) role to the development group on the `pubsub-prod-data` project.Answer
- CAssign the Editor (`roles/editor`) role to the development group on the `pubsub-prod-data` project.
- DAssign the Pub/Sub Viewer (`roles/pubsub.viewer`) role to the development group at the parent Folder level.
Answer
Assign the Pub/Sub Viewer (`roles/pubsub.viewer`) role and the Monitoring Viewer (`roles/monitoring.viewer`) role to the development group directly on the `pubsub-prod-data` project.
The principle of least privilege requires assigning fine-grained predefined roles at the lowest necessary level of the resource hierarchy. Assigning Pub/Sub Viewer and Monitoring Viewer directly on the specific project grants exactly the required read-only permissions for Pub/Sub resources and Monitoring metrics without exposing other projects in the folder or enabling resource modification.
Step-by-Step Solution
Key Concept
Applying principle of least privilege using predefined roles at the appropriate resource hierarchy scope