Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A software engineering company structures its Google Cloud resource hierarchy using environment-specific folders. The security team needs to grant a group of data engineers the ability to manage BigQuery datasets and view Cloud Storage object contents across all current and future projects located under the 'Analytics-Staging' folder. The solution must adhere to the principle of least privilege, avoid primitive roles, and minimize administrative overhead. Which TWO actions should the security team perform to meet these requirements?

  1. Grant the BigQuery Admin (`roles/bigquery.admin`) role to the data engineers Google Group at the 'Analytics-Staging' folder level.Answer
  2. Grant the Storage Object Viewer (`roles/storage.objectViewer`) role to the data engineers Google Group at the 'Analytics-Staging' folder level.Answer
  3. C
    Grant the primitive Editor (`roles/editor`) role to individual data engineer user accounts on each project within the 'Analytics-Staging' folder.
  4. D
    Grant the Service Account Admin (`roles/iam.serviceAccountAdmin`) role to the data engineers Google Group at the Organization root level.

Answer

Grant the BigQuery Admin role (`roles/bigquery.admin`) and the Storage Object Viewer role (`roles/storage.objectViewer`) to the data engineers Google Group at the 'Analytics-Staging' folder level.
Granting predefined fine-grained roles (`roles/bigquery.admin` and `roles/storage.objectViewer`) at the folder level leverages GCP resource hierarchy inheritance. This ensures that permissions propagate automatically to all current and future projects in the folder while strictly adhering to least privilege.

Step-by-Step Solution

1
Determine the optimal resource hierarchy scope to minimize operational overhead.
Applying IAM roles at the 'Analytics-Staging' folder level ensures that all existing and future child projects automatically inherit the permissions.
Folder-level permission bindings eliminate the need to manually configure permissions on individual projects.
2
Select predefined IAM roles that fulfill the specific job duties without over-granting access.
Assigning `roles/bigquery.admin` grants dataset administrative rights, while `roles/storage.objectViewer` permits reading Cloud Storage objects.
Predefined roles enforce least privilege compared to broad primitive roles like Editor or Owner.

Key Concept

Resource Hierarchy IAM Role Inheritance and Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy