A media streaming company organizes its Google Cloud resources using a folder hierarchy where each media platform (such as Video, Audio, and Gaming) has a dedicated folder containing multiple production and staging projects. The central security operations team needs to review security configurations and inspect IAM policies across all current and future projects in the 'Audio' folder without being able to read data stored inside Cloud Storage buckets or Cloud Bigtable instances, and without making configuration changes. Which approach follows Google-recommended best practices while minimizing administrative overhead?
- Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the security operations group at the 'Audio' folder level.Answer
- BGrant the primitive Viewer role (roles/viewer) to the security operations group at the 'Audio' folder level.
- CGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the security operations group on each project inside the 'Audio' folder.
- DCreate a VPC Service Controls perimeter encompassing the 'Audio' folder to grant access to configuration metadata while preventing data exfiltration.
Answer
Grant the predefined Security Reviewer role (roles/iam.securityReviewer) to the security operations group at the 'Audio' folder level.
Granting the Security Reviewer role at the folder level enforces least privilege by allowing access only to security configurations and IAM policies, while resource hierarchy inheritance automatically applies these permissions to all projects created under the folder.
Step-by-Step Solution
Key Concept
Resource Hierarchy Permission Inheritance and Predefined Security Roles