Examkin

Question

Difficulty: MediumOrganization Policies and Constraints

An enterprise cloud security architect needs to ensure that newly created Google Cloud projects do not automatically grant the primitive Editor role to default service accounts, such as the default Compute Engine service account. The guardrail must be centrally managed and automatically enforced across all current and future projects in the resource hierarchy without relying on post-provisioning scripts or manual developer compliance. Which approach meets these governance requirements?

  1. Enforce the `iam.automaticIamGrantsForDefaultServiceAccounts` boolean Organization Policy constraint at the Organization root level.Answer
  2. B
    Configure an automated Cloud Pub/Sub and Cloud Function pipeline to remove primitive IAM roles from default service accounts after project creation.
  3. C
    Establish a VPC Service Controls perimeter around all newly created projects to restrict access to default service accounts.
  4. D
    Revoke the Service Account User role (`roles/iam.serviceAccountUser`) from project creators at the Organization level.

Answer

Enforce the `iam.automaticIamGrantsForDefaultServiceAccounts` boolean Organization Policy constraint at the Organization root level.
Enforcing the boolean Organization Policy constraint `iam.automaticIamGrantsForDefaultServiceAccounts` at the Organization root level ensures that when service APIs (such as Compute Engine) are enabled in any project, Google Cloud does not automatically grant the primitive Editor role to default service accounts. Because Organization Policies inherit down the resource hierarchy, setting this at the root guarantees proactive compliance for all current and future projects.

Step-by-Step Solution

1
Identify the compliance requirement
Prevent automatic assignment of the primitive Editor role to default service accounts across all projects.
Default service accounts created when APIs (like Compute Engine) are enabled receive broad Editor permissions by default, violating least privilege principles.
2
Evaluate Google Cloud preventative guardrail mechanisms
Organization Policy constraints provide proactive, centralized policy enforcement across the resource hierarchy.
Organization Policies enforce constraints at creation time, ensuring policy compliance without operational overhead or delay.
3
Select the specific constraint for default service account IAM grants
Apply `iam.automaticIamGrantsForDefaultServiceAccounts` at the Organization node.
This specific boolean constraint stops GCP from binding primitive roles to default service accounts, inheriting down to all folders and projects.

Key Concept

Organization Policy Boolean Constraints for Service Account Security
Estimated Time:1m 30s
Rate this question

Topics

Organization Policies and Constraints

More questions from this topic