Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A global online gaming enterprise manages its Google Cloud infrastructure using a resource hierarchy that includes a top-level folder named `Game-Services`. Developers in the engineering group require permissions to inspect Cloud Logging entries for all workload projects nested inside this folder, as well as the ability to attach specific predefined deployment service accounts when launching Cloud Run services. Additionally, an external automated CI/CD pipeline requires permissions to act on behalf of a dedicated deployment service account without obtaining excessive administrative control over service accounts. Following Google-recommended best practices for security and resource hierarchy governance, which TWO configuration actions should the cloud security architect implement?

  1. Grant the Logging Viewer role (roles/logging.viewer) to the developers' Google Group at the `Game-Services` folder node, and grant the Service Account User role (roles/iam.serviceAccountUser) to the group on the specific target deployment service accounts.Answer
  2. B
    Grant the Editor primitive role (roles/editor) to the developers' Google Group at the `Game-Services` folder node to satisfy both logging inspection and application deployment requirements.
  3. Grant the Workload Identity User role (roles/iam.workloadIdentityUser) to the external CI/CD principal directly on the target deployment service account.Answer
  4. D
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the external CI/CD principal at the Organization node level.

Answer

The cloud security architect should grant the Logging Viewer role to the developers' group at the folder level alongside the Service Account User role on specific service accounts, and grant the Workload Identity User role to the CI/CD principal directly on the target deployment service account.
To satisfy least privilege while minimizing management overhead, log viewing should be granted via the predefined Logging Viewer role at the `Game-Services` folder level so it inherits down to all child projects. Permitting users to deploy services with service accounts requires granting the Service Account User role scoped directly to the target service accounts. For automated CI/CD pipelines authentication via Workload Identity, binding the Workload Identity User role directly on the target service account grants required execution rights without administrative privileges.

Step-by-Step Solution

1
Analyze resource hierarchy inheritance for log viewing
Binding `roles/logging.viewer` to the developers' group on the `Game-Services` folder node ensures inherited read access to Cloud Logging entries across all child projects without over-granting project modification access.
IAM permissions set at a parent node in the GCP resource hierarchy inherit down to all contained child projects.
2
Evaluate service account attachment permissions
Binding `roles/iam.serviceAccountUser` specifically on the target service accounts grants developers permission to attach those service accounts to compute resources without allowing them to modify the service accounts themselves.
Granting permissions on individual service account resource instances adheres strictly to the principle of least privilege.
3
Configure external CI/CD impersonation
Binding `roles/iam.workloadIdentityUser` to the CI/CD identity principal on the specific deployment service account allows secure token exchange and impersonation for automated deployments.
Workload Identity Federation combined with service account level impersonation avoids service account key creation and limits access scope.

Key Concept

Fine-grained IAM role scoping across resource hierarchy nodes and service account impersonation controls
Estimated Time:2m 30s
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy