A logistics enterprise manages its Google Cloud environment using a parent folder named 'Fleet-Operations', which contains separate sub-folders for 'Production', 'Staging', and 'Development' environments. The operational safety engineering team requires read-only visibility into Compute Engine Virtual Machines (VMs) across all workloads under 'Fleet-Operations' to inspect instance configurations and operational metrics without modifying running instances or viewing object storage data. Which administrative action adheres to the principle of least privilege while minimizing operational complexity?
- Grant the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group on the 'Fleet-Operations' folder node.Answer
- BGrant the primitive Editor role (roles/editor) to the safety engineering group on the 'Fleet-Operations' folder node.
- CGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the safety engineering group individually inside every project under the sub-folders.
- DGrant the Storage Admin role (roles/storage.admin) to the safety engineering group on the Organization node to enable complete system visibility.
Answer
Granting the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group at the 'Fleet-Operations' folder node.
Assigning the predefined Compute Viewer role at the top parent folder node leverages resource hierarchy inheritance. All current and future projects beneath the 'Fleet-Operations' folder automatically inherit read-only access to Compute Engine resources without giving access to modify resources or inspect object storage payload data.
Step-by-Step Solution
Key Concept
Resource Hierarchy IAM Role Inheritance and Predefined Roles