Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A healthcare enterprise manages several data analytics workloads across multiple projects contained within a folder named Clinical-Analytics in its Google Cloud resource hierarchy. A deployment automation pipeline uses a primary service account to create Compute Engine instances in any project under this folder. The pipeline must also attach an existing runtime service account to these newly provisioned instances. Which IAM role configuration meets these requirements while enforcing the principle of least privilege?

  1. Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) on the Clinical-Analytics folder to the deployment service account, and grant Service Account User (roles/iam.serviceAccountUser) on the runtime service account resource to the deployment service account.Answer
  2. B
    Grant Editor (roles/editor) on the Clinical-Analytics folder to the deployment service account so it inherits all required Compute Engine and IAM permissions across child projects.
  3. C
    Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) on the Clinical-Analytics folder to the deployment service account, and grant Service Account Admin (roles/iam.serviceAccountAdmin) on the runtime service account to the deployment service account.
  4. D
    Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) and Service Account User (roles/iam.serviceAccountUser) at the Organization node level to ensure all resource movement across folders automatically prevents unauthorized data exfiltration.

Answer

Grant Compute Instance Admin (roles/compute.instanceAdmin.v1) on the Clinical-Analytics folder to the deployment service account, and grant Service Account User (roles/iam.serviceAccountUser) on the runtime service account resource to the deployment service account.
The correct solution leverages resource hierarchy inheritance by assigning Compute Instance Admin at the folder node level, granting provisioning permissions across all child projects. Scoping the Service Account User role directly on the runtime service account resource grants the automation account exact permission to attach the identity to instances without granting service account management rights.

Step-by-Step Solution

1
Analyze resource hierarchy inheritance requirements
Assigning Compute Instance Admin (roles/compute.instanceAdmin.v1) at the Clinical-Analytics folder level ensures that all existing and future projects within the folder inherit instance management capabilities automatically.
Folder-level IAM bindings propagate down the resource hierarchy to child projects, avoiding manual project-by-project role assignments.
2
Determine the minimal permission needed to bind a runtime identity to Compute Engine instances
The deployment service account requires the Service Account User role (roles/iam.serviceAccountUser) specifically scoped to the target runtime service account.
This permission allows an identity to attach a service account to a compute resource without giving administrative privileges over the service account itself.
3
Evaluate distractors against least privilege principles
Reject options that use primitive roles (Editor), grant full service account management (Service Account Admin), or grant Organization-wide permissions.
Custom and predefined fine-grained roles scoped to the narrowest resource boundary (folder and service account resource) strictly follow Google Cloud security recommendations.

Key Concept

Resource Hierarchy IAM Inheritance & Service Account Impersonation
Estimated Time:2m 0s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy