Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A digital streaming platform organizes its Google Cloud environment into environment-specific folders. A team of software engineers needs permission to manage Compute Engine instances and attach existing managed service accounts to those instances across all projects under the `Engineering-Staging` folder. The security team requires that engineers must not be granted permissions to modify service account credentials, create new service accounts, or grant IAM permissions to other users. Which IAM role assignment strategy complies with the principle of least privilege while minimizing operational administrative overhead?

  1. Grant roles/compute.instanceAdmin.v1 and roles/iam.serviceAccountUser to the engineering group on the Engineering-Staging folder.Answer
  2. B
    Grant roles/editor to the engineering group on the Engineering-Staging folder.
  3. C
    Grant roles/compute.instanceAdmin.v1 and roles/iam.serviceAccountAdmin to the engineering group on the Engineering-Staging folder.
  4. D
    Grant roles/owner to the engineering group individually on each project contained within the Engineering-Staging folder.

Answer

Grant roles/compute.instanceAdmin.v1 and roles/iam.serviceAccountUser to the engineering group on the Engineering-Staging folder.
Binding `roles/compute.instanceAdmin.v1` and `roles/iam.serviceAccountUser` to a Google Group at the folder level allows the group to manage virtual machines and attach existing service accounts across all current and future projects in that folder, adhering to least privilege and reducing management complexity.

Step-by-Step Solution

1
Analyze resource hierarchy scoping requirements.
Applying permissions at the parent folder level (`Engineering-Staging`) ensures all current and future child projects inherit identical access automatically, minimizing operational overhead.
IAM permissions set on parent nodes inherit down the resource hierarchy.
2
Select compute management role.
`roles/compute.instanceAdmin.v1` grants full control over Compute Engine instances without granting project ownership or IAM editing capabilities.
Matches the least privilege requirement for compute instance operations.
3
Select service account usage role.
`roles/iam.serviceAccountUser` allows users to bind existing service accounts to instances without permitting administrative control or key generation on the service accounts.
Allows impersonation/usage without granting full administrative privileges over service accounts (`roles/iam.serviceAccountAdmin`).

Key Concept

Resource Hierarchy IAM Inheritance and Service Account User Scoping
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy