Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise security team needs to grant an automated compliance auditing application running in a dedicated security project permission to inspect resource configurations and IAM policies across all projects nested within a folder named Production-Workloads. The security team must also allow a DevOps engineer to deploy and attach this service account to Compute Engine audit instances without granting the engineer the ability to modify IAM policies or elevate their own privileges. Which TWO configuration steps should the security architect implement to achieve this with minimal operational overhead and least privilege? (Select TWO.)

  1. Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level.Answer
  2. Grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.Answer
  3. C
    Grant the automated service account the primitive Viewer role (roles/viewer) bound at the Organization root node.
  4. D
    Grant the DevOps engineer the Service Account Admin role (roles/iam.serviceAccountAdmin) bound at the Production-Workloads folder level.

Answer

Grant the automated service account the Cloud Asset Viewer role (roles/cloudasset.viewer) bound at the Production-Workloads folder level, and grant the DevOps engineer the Service Account User role (roles/iam.serviceAccountUser) on the specific audit service account resource.
Inheriting permissions from the folder level enables an automated service account to inspect assets across all child projects using a targeted predefined role. Restricting the DevOps engineer's permissions to the Service Account User role scoped specifically to the target service account permits deployment onto compute resources while preventing administrative privilege escalation.

Step-by-Step Solution

1
Determine the optimal scoping and role for the automated auditing application.
Identify that Cloud Asset Viewer (roles/cloudasset.viewer) provides read access to metadata and IAM policies across resources without exposing underlying payload data.
Granting this role at the Production-Workloads folder level leverages resource hierarchy inheritance to cover all current and future child projects automatically.
2
Determine the least-privilege permission required for the DevOps engineer deploying the compute workload.
Assign the Service Account User role (roles/iam.serviceAccountUser) directly on the target service account resource.
This grants the engineer permission to impersonate or bind the service account to Compute Engine instances without granting Service Account Admin rights or folder-wide IAM administrative capabilities.

Key Concept

Resource Hierarchy IAM Inheritance and Service Account Impersonation Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy