An autonomous drone logistics company organizes its Google Cloud resource hierarchy into regional folders under a top-level organization node. A security team needs to grant a regional operations team permission to manage Compute Engine virtual machines (deploy, start, stop) and attach existing service accounts to these VMs within the 'North-America-Ops' folder. The solution must strictly adhere to the principle of least privilege and eliminate administrative access over service account configurations. Which TWO IAM configuration steps should the security team implement? (Select TWO.)
- Bind the Compute Instance Admin (v1) predefined role (roles/compute.instanceAdmin.v1) to the regional operations team's Google Group at the 'North-America-Ops' folder level.Answer
- Bind the Service Account User role (roles/iam.serviceAccountUser) to the regional operations team's Google Group on the specific service accounts assigned to the workload.Answer
- CBind the Editor primitive role (roles/editor) to the regional operations team's Google Group at the 'North-America-Ops' folder level.
- DBind the Service Account Admin role (roles/iam.serviceAccountAdmin) to the regional operations team's Google Group at the project level.
Answer
The security team should grant the Compute Instance Admin (v1) role at the regional folder level and grant the Service Account User role on the specific workload service accounts.
To satisfy least privilege while managing Compute Engine instances across multiple projects in a folder, the Compute Instance Admin (v1) role should be bound at the folder level. To allow binding specific service accounts to instances without granting permission to manage service account IAM policies or keys, the Service Account User role must be granted on those specific service accounts.
Step-by-Step Solution
Key Concept
Resource hierarchy inheritance and fine-grained service account delegation using standard IAM roles