A healthcare analytics platform organizes its workload projects under a dedicated `Clinical-Analytics` folder within the Google Cloud resource hierarchy. The security team needs to grant a centralized monitoring team read-only access to inspect Cloud Logging logs for all current and future projects within this folder. The solution must strictly adhere to the principle of least privilege without exposing underlying dataset contents in Cloud Storage or BigQuery. Which IAM configuration strategy should the architect recommend to meet these requirements with minimal administrative overhead?
- Grant the predefined `roles/logging.viewer` role to the monitoring team's Google Group at the `Clinical-Analytics` folder level.Answer
- BGrant the primitive `roles/viewer` role to the monitoring team's Google Group at the `Clinical-Analytics` folder level.
- CGrant the `roles/iam.serviceAccountAdmin` role to the monitoring team's Google Group on all project-level service accounts.
- DConfigure VPC Service Controls perimeter rules around the folder to grant log access while blocking data egress to external locations.
Answer
Granting the predefined `roles/logging.viewer` role to the monitoring team's Google Group at the `Clinical-Analytics` folder level fulfills the requirement using least privilege and resource hierarchy inheritance.
Granting the predefined `roles/logging.viewer` role at the folder level leverages Google Cloud resource hierarchy inheritance. All child projects under the `Clinical-Analytics` folder automatically inherit this access without granting read access to underlying storage buckets or database tables.
Step-by-Step Solution
Key Concept
GCP IAM Resource Hierarchy Inheritance and Predefined Roles