Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A media enterprise organizes its Google Cloud environment into a parent folder named 'Video-Streaming', which contains sub-folders for 'Transcoding' and 'Distribution'. An automated deployment pipeline using a dedicated service account needs to create and delete Compute Engine VM instances across all projects under both sub-folders. The pipeline must not be granted permissions to modify IAM security policies, manage service accounts, or alter VPC firewall rules. Which IAM role configuration meets these requirements while adhering to the principle of least privilege and minimizing maintenance overhead?

  1. Grant the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) to the pipeline service account at the 'Video-Streaming' folder level.Answer
  2. B
    Grant the Editor primitive role (roles/editor) to the pipeline service account at the 'Video-Streaming' folder level.
  3. C
    Grant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the pipeline service account on each project within the 'Transcoding' and 'Distribution' sub-folders.
  4. D
    Grant the Compute Admin role (roles/compute.admin) to the pipeline service account at the project level and configure IAM conditions to restrict data exfiltration across VPC perimeters.

Answer

Grant the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) to the pipeline service account at the 'Video-Streaming' folder level.
The correct option applies the predefined `roles/compute.instanceAdmin.v1` role at the parent folder node in the resource hierarchy. Google Cloud IAM permissions inherit down the resource tree, so binding the role at the parent folder grants the necessary VM lifecycle permissions across all child folders and projects while maintaining least privilege and reducing management complexity.

Step-by-Step Solution

1
Identify the required operational capabilities for the service account.
The service account needs to manage Compute Engine VM instances (create and delete) without broader permissions over networking, IAM policies, or service account management.
Following the principle of least privilege requires selecting a fine-grained predefined role rather than broad administrative or primitive roles.
2
Evaluate the IAM role that aligns with the instance management requirements.
The predefined role `roles/compute.instanceAdmin.v1` allows full control of Compute Engine instances while omitting networking administration and IAM modification capabilities.
This predefined role grants exact permissions required for VM operations without security over-privilege.
3
Determine the resource hierarchy binding level to minimize administrative overhead.
Binding the role at the 'Video-Streaming' parent folder level automatically inherits permissions down to all projects in the 'Transcoding' and 'Distribution' sub-folders.
Resource hierarchy inheritance allows centralized access management at the parent container level instead of configuring redundant bindings on individual child projects.

Key Concept

GCP IAM Role Scoping and Resource Hierarchy Inheritance
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy