Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A financial technology enterprise uses a Google Cloud resource hierarchy containing a top-level folder named Payments-Service. The security team needs to grant an automated CI/CD deployment service account permission to manage Compute Engine resources across all present and future projects under the Payments-Service folder. Additionally, DevOps engineers must be able to deploy virtual machines running as this service account in specific projects without gaining permission to modify the service account itself. Which two actions should you take to implement this access model following Google-recommended best practices? (Select TWO.)

  1. Grant the Compute Admin role (`roles/compute.admin`) to the CI/CD service account at the Payments-Service folder level.Answer
  2. Grant the Service Account User role (`roles/iam.serviceAccountUser`) to DevOps engineers on the specific service account resource.Answer
  3. C
    Grant the Editor primitive role (`roles/editor`) to the CI/CD service account at the Organization node level.
  4. D
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to DevOps engineers at the Payments-Service folder level.

Answer

The correct architecture requires binding the Compute Admin predefined role to the CI/CD service account at the folder level to exploit IAM resource hierarchy inheritance, and granting the Service Account User role to DevOps engineers specifically on the service account identity resource.
Predefined roles bound at folder scope pass down permissions to child projects automatically via IAM resource hierarchy inheritance. Granting the Service Account User role on the identity resource ensures engineers can attach the service account to compute instances without gaining excessive administrative rights over the service account identity.

Step-by-Step Solution

1
Identify the appropriate scoping for Compute Engine administration across multiple projects.
Inheritance from the Payments-Service folder node down to all child project resources.
Applying IAM roles at higher hierarchy nodes avoids manual per-project bindings and ensures automated governance.
2
Select fine-grained predefined roles over primitive roles.
Compute Admin (`roles/compute.admin`) selected for infrastructure deployment tasks.
Predefined roles restrict permissions to specific GCP services rather than granting broad project-wide modification rights.
3
Delegate service account impersonation rights safely.
Service Account User (`roles/iam.serviceAccountUser`) granted on the target service account resource.
Engineers only need permission to attach the identity to instances, not permissions to edit or manage the service account itself.

Key Concept

IAM Resource Hierarchy Inheritance and Service Account Least Privilege
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy