Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A cloud security architect is establishing permission inheritance across a newly created Google Cloud resource hierarchy for an automated compliance audit tool. Arrange the following implementation steps in the correct sequential order, starting from top-level organization governance down to granular resource-level access enforcement.

  1. 1Apply Organization-level IAM role bindings to grant broad baseline read permissions across all current and future child resources.
  2. 2Create dedicated Folder nodes to group projects by operational environment and compliance boundary.
  3. 3Assign predefined IAM roles at the Project level to grant environment-specific permissions to service accounts.
  4. 4Attach conditional IAM policy bindings directly on individual Cloud Storage buckets to enforce precise resource-level restrictions.

Answer

The correct sequence starts with applying Organization-level IAM bindings, followed by creating dedicated Folder nodes, then assigning predefined IAM roles at the Project level, and finally attaching conditional IAM policy bindings on specific Cloud Storage buckets.
In Google Cloud, permissions flow downwards through the resource hierarchy: Organization → Folders → Projects → Resources. Setting up policy governance follows this top-down structure, establishing organization-wide baselines first, structuring organizational folder units next, configuring project IAM roles third, and finally applying fine-grained resource-level bindings at the bottom.

Step-by-Step Solution

1
Establish root organization governance
Organization-level IAM bindings provide baseline visibility that inherits down the resource hierarchy.
Permissions in Google Cloud inherit downwards from the Organization root node to all descendant folders, projects, and resources.
2
Construct folder hierarchy boundaries
Folders organize projects into logical groupings under the Organization node.
Structuring folders enables administrative grouping before assigning project-specific or environment-specific security controls.
3
Grant project-level roles
Predefined roles bound at the project level control service account access within that project scope.
Project IAM policies narrow down broad organization permissions to project-specific workload requirements.
4
Enforce resource-level conditional access
Resource-level policy bindings restrict access to specific assets like Cloud Storage buckets.
Applying bindings directly to individual resources provides the most granular enforcement of least privilege at the leaf nodes of the hierarchy.

Key Concept

Resource Hierarchy Permission Inheritance and Downward IAM Policy Flow
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy