Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A healthcare analytics application runs on Compute Engine virtual machines inside a dedicated Google Cloud production folder. The application must run automated night jobs that query BigQuery datasets and write log entries to Cloud Logging. The security team mandates strict enforcement of least privilege while keeping administrative overhead minimal. Which IAM role configuration strategy should the Cloud Architect recommend?

  1. Attach a custom user-managed service account to the virtual machines, granting the service account the BigQuery Data Viewer role at the dataset scope and Logs Writer role at the project scope.Answer
  2. B
    Attach the default Compute Engine service account to the virtual machines with the primitive Editor role granted at the parent folder level.
  3. C
    Grant the application developers the Service Account Admin role across the production project so the virtual machines can automatically query BigQuery and write logs.
  4. D
    Grant BigQuery Data Viewer to all domain users at the organization level, relying strictly on IAM policies without isolating workload identities or restricting egress access.

Answer

Attach a dedicated user-managed service account to the virtual machines, granting least-privilege predefined roles (BigQuery Data Viewer on specific datasets and Logs Writer at the project level).
Attaching a user-managed service account with fine-grained predefined roles (BigQuery Data Viewer at dataset scope, Logs Writer at project scope) adheres directly to Google Cloud security best practices for workload identity and least privilege.

Step-by-Step Solution

1
Identify the workload identity requirements
Determine that automated virtual machine workloads require distinct identity representation separate from human users or default service accounts.
Using default compute service accounts with broad scopes introduces operational and security risks.
2
Scope permissions using predefined roles
Select `roles/bigquery.dataViewer` for dataset read access and `roles/logging.logWriter` for ingestion.
Predefined fine-grained roles avoid over-granting administrative capabilities while satisfying operational needs.
3
Apply identity at the appropriate resource hierarchy level
Bind BigQuery permissions at dataset resource scope and Logging permissions at project scope.
Granting roles at the specific resource or project boundary prevents unauthorized access to unrelated resources inherited from parent folders.

Key Concept

Applying least privilege IAM roles to user-managed service accounts across Google Cloud resource hierarchy
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy