Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

A media streaming company structures its Google Cloud resource hierarchy into an Organization node with environment folders, including a dedicated Production-Workloads folder and a separate Tools-and-CI project. An automated CI/CD pipeline running on a Compute Engine instance in the Tools-and-CI project uses a dedicated deployment Service Account to manage application compute instances inside projects under the Production-Workloads folder. Developers need to trigger builds that execute deployment tasks through this pipeline, but security governance requires enforcing least privilege while preventing developers from altering the deployment Service Account policy or accessing production instances directly. How should IAM roles and resource hierarchy bindings be configured to meet these requirements?

  1. Grant the Compute Instance Admin (v1) role to the deployment Service Account at the Production-Workloads folder level, and grant the Service Account User role on the deployment Service Account to the developer group at the Tools-and-CI project level.Answer
  2. B
    Grant the primitive Editor role to the deployment Service Account at the Organization node level, and grant the primitive Viewer role to the developer group at the Production-Workloads folder level.
  3. C
    Grant the Compute Instance Admin (v1) role to the deployment Service Account at the Production-Workloads folder level, and grant the Service Account Admin role on the deployment Service Account to the developer group.
  4. D
    Grant the Compute Admin role to the deployment Service Account at the Production-Workloads folder level, relying exclusively on IAM resource hierarchy bindings to prevent automated pipeline instances from copying sensitive data to unauthorized external Cloud Storage buckets.

Answer

Granting the Compute Instance Admin (v1) role to the deployment Service Account at the Production-Workloads folder level, and granting the Service Account User role on the deployment Service Account to the developer group at the Tools-and-CI project level.
The solution granting Compute Instance Admin (v1) at the folder level and Service Account User on the target service account enforces strict least privilege. The deployment service account receives specific compute privileges inherited by all projects in the target folder, while developers receive only the permission to run jobs under the service account identity without gaining administrative power over the service account itself.

Step-by-Step Solution

1
Determine appropriate resource hierarchy scoping for compute workload management.
Binding the predefined role roles/compute.instanceAdmin.v1 at the Production-Workloads folder level ensures all current and future projects under that folder inherit permissions to manage compute instances without granting global organization access.
IAM roles applied at a folder node propagate down to all contained project resources via hierarchy inheritance.
2
Select the minimal IAM role required for developers to deploy workloads via the Service Account.
Developers require roles/iam.serviceAccountUser on the deployment Service Account to attach or act as the identity during pipeline execution.
The Service Account User role grants permission to use a service account for compute workloads without giving administrative permissions to edit keys, policies, or service account configurations.
3
Verify least privilege and operational security constraints.
Developers cannot directly SSH into production compute instances or alter service account security settings, satisfying security compliance.
Service Account User permissions are scoped strictly to impersonation/usage within the build project.

Key Concept

IAM resource hierarchy inheritance and Service Account User delegation
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy