A cloud administrator is setting up access controls for a departmental team in Google Cloud across multiple projects inside a designated folder. Which TWO access management strategies follow Google Cloud recommended best practices for resource hierarchy and Identity and Access Management (IAM)?
- Grant predefined IAM roles at the folder level to allow permissions to automatically inherit down to all child projects within that department.Answer
- Assign fine-grained predefined roles matching specific job responsibilities rather than using primitive roles.Answer
- CGrant the primitive Editor role at the Organization level to ensure team members have uninterrupted access across all infrastructure.
- DGrant the Service Account Admin role to Compute Engine instances to allow them to execute workloads under identity credentials.
Answer
The correct access management strategies are granting predefined IAM roles at the folder level to leverage resource hierarchy inheritance, and assigning fine-grained predefined roles tailored to specific job responsibilities instead of primitive roles.
In Google Cloud IAM, permissions inherit downward through the resource hierarchy. Applying predefined roles at the folder level simplifies administration while automatically applying permissions to child projects. Furthermore, assigning fine-grained predefined roles guarantees that identities receive only the specific access required for their operational tasks.
Step-by-Step Solution
Key Concept
IAM Resource Hierarchy Inheritance and Fine-Grained Predefined Roles