A financial technology enterprise structures its Google Cloud resource hierarchy using dedicated environment folders, including a parent folder named 'Payments-Prod'. The security auditing team requires read-only access to examine Cloud Logging log entries across all current and future projects located beneath the 'Payments-Prod' folder tree. Which IAM configuration adheres to Google Cloud recommended best practices for enforcing least privilege while minimizing administrative overhead?
- Grant the Logs Viewer role (roles/logging.viewer) to the auditing team's Google Group at the 'Payments-Prod' folder level.Answer
- BGrant the Viewer primitive role (roles/viewer) to the auditing team's Google Group at the 'Payments-Prod' folder level.
- CGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the auditing team at the organization level to allow service account impersonation.
- DConfigure a VPC Service Controls perimeter encompassing the 'Payments-Prod' folder without altering project IAM roles.
Answer
Grant the Logs Viewer role (roles/logging.viewer) to the auditing team's Google Group at the 'Payments-Prod' folder level.
Granting the predefined Logs Viewer role at the folder level leverages IAM policy inheritance across the resource hierarchy. All current and future projects in the 'Payments-Prod' folder inherit this access automatically, satisfying least privilege without requiring primitive roles or operational overhead.
Step-by-Step Solution
Key Concept
Resource Hierarchy IAM Policy Inheritance and Predefined Roles