Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A biotechnology firm is setting up a secure, isolated environment for a genomic data analytics pipeline in Google Cloud. The lead cloud security architect must establish a resource hierarchy and grant access using custom IAM roles while maintaining minimal operational overhead and strict least-privilege access controls. Arrange the implementation steps in the correct chronological sequence from first to last to establish the resource hierarchy and role inheritance correctly.

  1. 1Create a dedicated folder named 'Genomics-Pipeline' directly under the Organization node.
  2. 2Define a Custom IAM Role at the Organization level containing only the required granular API permissions.
  3. 3Bind the Custom IAM Role to the analytics service account at the 'Genomics-Pipeline' folder level.
  4. 4Provision the data processing GCP Project inside the 'Genomics-Pipeline' folder.

Answer

The correct order to establish the resource hierarchy and IAM role inheritance is: 1) Create the 'Genomics-Pipeline' folder under the Organization node, 2) Define the Custom IAM Role at the Organization level, 3) Bind the Custom IAM Role to the service account at the folder level, and 4) Provision the GCP Project inside the folder.
The correct implementation sequence establishes administrative containers first (Folder under Organization), centralizes privilege definitions (Organization-level Custom IAM Role), applies policy bindings to the folder container, and finally provisions child resources (GCP Project inside the Folder) that inherit the established policies. This adheres to Google Cloud recommended practices for least privilege and resource hierarchy inheritance.

Step-by-Step Solution

1
Establish the resource hierarchy folder container.
The folder node exists under the Organization to act as an administrative boundary.
Creating the folder first defines the parent node where policy inheritance will be enforced.
2
Define the Custom IAM Role at the Organization level.
The role definition is centralized and accessible across the entire resource hierarchy.
Organization-level role definition enables broad reusability and centralized maintenance across folders and projects.
3
Attach the role binding to the target service account at the folder level.
IAM policy binding is associated with the folder node.
Applying the binding at the folder level allows all descendant projects to inherit the access control policy.
4
Create the GCP project within the folder.
The project inherits folder-level IAM policies immediately upon creation.
Placing the project inside the folder ensures resources inherit access policies without requiring manual per-project permission grants.

Key Concept

IAM Resource Hierarchy Inheritance and Organization-Level Custom Role Scoping
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy