Examkin

Question

Difficulty: EasyIdentity and Access Management (IAM) Roles and Resource Hierarchy

A company organizes its Google Cloud resources into dedicated folders per department. The security team needs to grant a developer group read-only access to object content in all Cloud Storage buckets across all projects contained within the 'Data Analytics' folder. The solution must follow Google recommended best practices for least privilege and operational simplicity. Which IAM role assignment strategy should be implemented?

  1. Grant the predefined Storage Object Viewer role (roles/storage.objectViewer) to the group at the 'Data Analytics' folder level.Answer
  2. B
    Grant the primitive Editor role (roles/editor) to the group at the 'Data Analytics' folder level.
  3. C
    Grant the Service Account User role (roles/iam.serviceAccountUser) to the group at the Organization root level.
  4. D
    Rely solely on VPC Service Controls perimeters around the projects without binding any IAM roles at the folder or project level.

Answer

Granting the predefined Storage Object Viewer role at the folder level leverages IAM resource hierarchy inheritance while enforcing the principle of least privilege.
In Google Cloud IAM, permissions defined on parent resources (such as Folders) are inherited downstream by all child resources (such as Projects and Cloud Storage buckets). Granting the predefined Storage Object Viewer role at the target folder level ensures that users receive the exact read permissions required for all present and future projects under that folder without granting unnecessary permissions.

Step-by-Step Solution

1
Identify the resource scope and target permission requirement.
Access is needed for multiple projects inside a single folder ('Data Analytics'), specifically requiring read access to Cloud Storage objects.
Determining the parent resource container allows using IAM permission inheritance effectively.
2
Select the appropriate IAM role type adhering to least privilege.
The predefined role 'roles/storage.objectViewer' provides exact read permissions for Cloud Storage objects without granting broad administrative privileges.
Predefined roles are preferred over primitive roles (Owner/Editor/Viewer) to restrict access to only what is required.
3
Apply the role binding at the optimal level in the Google Cloud resource hierarchy.
Binding the role at the 'Data Analytics' folder level automatically propagates access to all child projects and buckets via inheritance.
Folder-level binding avoids repetitive per-project or per-bucket configuration, minimizing operational maintenance.

Key Concept

Resource hierarchy inheritance and fine-grained predefined IAM roles
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy