Examkin

Question

Difficulty: MediumIdentity and Access Management (IAM) Roles and Resource Hierarchy

A retail enterprise manages its workloads using a Google Cloud resource hierarchy structured with an Organization node and separate parent folders named Non-Production and Production. The Non-Production folder contains multiple projects dedicated to software development and automated testing. An external CI/CD deployment pipeline requires permissions to create, modify, and delete Compute Engine virtual machine instances and attached persistent disks across all current and future projects under the Non-Production folder. The security team requires that the solution minimizes management overhead while enforcing the principle of least privilege. Which IAM role assignment strategy should a Cloud Architect recommend?

  1. Grant the predefined Compute Instance Admin (v1) role to the deployment pipeline service account at the Non-Production folder level.Answer
  2. B
    Grant the Editor primitive role to the deployment pipeline service account at the Organization level.
  3. C
    Grant the Service Account Admin role to the deployment pipeline service account on every project inside the Non-Production folder.
  4. D
    Grant the Editor primitive role to the deployment pipeline service account on each project inside the Non-Production folder and configure VPC Service Controls to prevent exfiltration.

Answer

Granting the predefined Compute Instance Admin (v1) role to the deployment pipeline service account at the Non-Production folder level satisfies least privilege and scales across all child projects automatically.
Granting the predefined Compute Instance Admin (v1) role at the Non-Production folder level relies on Google Cloud resource hierarchy inheritance. Any present or future project created under the Non-Production folder inherits this binding automatically, reducing administrative overhead. Additionally, using a predefined compute role rather than a primitive role ensures the service account receives only the permissions needed to manage Compute Engine resources.

Step-by-Step Solution

1
Analyze resource scope and inheritance requirements.
The permissions must apply across all current and future projects located within the Non-Production folder tree.
IAM permissions assigned at a parent folder level are inherited down the resource hierarchy to all descendant child projects, minimizing maintenance effort.
2
Select the appropriate IAM role type adhering to least privilege.
The predefined Compute Instance Admin (v1) role (`roles/compute.instanceAdmin.v1`) provides full control over Compute Engine instances and disks without granting unrelated administrative permissions across other GCP services.
Predefined roles are preferred over primitive roles (Owner, Editor, Viewer) to prevent unnecessary administrative access.
3
Combine resource hierarchy scoping with predefined role binding.
Binding `roles/compute.instanceAdmin.v1` to the service account at the Non-Production folder level achieves automated inheritance and operational efficiency.
This avoids per-project manual configuration while keeping permissions restricted exclusively to non-production compute resources.

Key Concept

IAM Resource Hierarchy Inheritance and Predefined Role Scoping
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy