Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A global gaming enterprise structures its Google Cloud resource hierarchy using an Organization node with a dedicated parent folder named 'Game-Backend-Services'. Multiple child projects beneath this folder host Google Kubernetes Engine (GKE) clusters for microservice workloads. A central deployment service account requires permissions to deploy updated containerized workloads to all GKE clusters within this folder structure. The security team requires strict adherence to the principle of least privilege while avoiding repetitive per-project access management. Which IAM configuration should the cloud security architect recommend?

  1. Grant the Kubernetes Engine Developer role (roles/container.developer) to the service account at the 'Game-Backend-Services' folder level.Answer
  2. B
    Grant the Editor primitive role (roles/editor) to the service account at the 'Game-Backend-Services' folder level.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the service account at the 'Game-Backend-Services' folder level.
  4. D
    Grant the Kubernetes Engine Admin role (roles/container.admin) at the organization root level while relying strictly on standard IAM policy bindings to prevent unauthorized data exfiltration.

Answer

Granting the predefined Kubernetes Engine Developer role (roles/container.developer) at the 'Game-Backend-Services' folder level is the optimal IAM configuration.
In Google Cloud IAM, policy bindings set on parent resources (such as Folders) are inherited downstream by all child nodes (Projects and Resources). Granting the predefined 'roles/container.developer' role at the 'Game-Backend-Services' folder level satisfies the least privilege requirement by providing cluster deployment access without administrative rights, while eliminating the operational overhead of configuring separate bindings for every child project.

Step-by-Step Solution

1
Identify resource scope and inheritance model
Permissions granted at a parent folder level are inherited automatically by all current and future child projects under that folder.
Assigning access at the folder level fulfills the requirement to minimize administrative overhead across multiple workload projects.
2
Evaluate least privilege role requirements
The Kubernetes Engine Developer role (roles/container.developer) provides fine-grained permissions to create and manage application workloads inside GKE clusters without full cluster administration capabilities.
Predefined fine-grained roles avoid over-granting permissions compared to primitive roles or full administrative roles.

Key Concept

Resource Hierarchy IAM Policy Inheritance and Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy