Examkin

Question

Difficulty: HardIdentity and Access Management (IAM) Roles and Resource Hierarchy

An enterprise cloud security architect is documenting the evaluation order for Google Cloud Identity and Access Management (IAM) permissions. When a principal requests access to a Google Cloud resource, IAM evaluates policies hierarchically. Place the following evaluation steps in the correct order, starting from the initial policy evaluation check to the final access decision.

  1. 1Evaluate IAM Deny policies across all parent hierarchy nodes (Organization, Folder, Project); if a matching Deny rule exists, immediately block access.
  2. 2Evaluate inherited IAM Allow policy bindings at the Organization node level.
  3. 3Evaluate IAM Allow policy bindings at intermediate Folder and Project levels.
  4. 4Evaluate resource-level IAM Allow policy bindings directly on the target resource.
  5. 5Grant access if at least one matching Allow policy grants the required permission, otherwise enforce an implicit deny.

Answer

The correct evaluation sequence begins with checking IAM Deny policies across the hierarchy, followed by evaluating IAM Allow policy inheritance top-down from Organization to Folder/Project, checking target resource-level IAM Allow policies, and concluding with a final decision that defaults to implicit deny unless an Allow policy matches.
Google Cloud evaluates authorization requests by first checking IAM Deny policies at all hierarchy levels. If no Deny policy blocks the request, IAM checks for Allow policy bindings starting at the top of the resource hierarchy (Organization node), moving down through intermediate Folder and Project nodes, and finally checking resource-level policies. If any evaluated Allow policy grants the required permission, access is granted; otherwise, an implicit deny is enforced.

Step-by-Step Solution

1
Check for explicit IAM Deny policies across the resource hierarchy
If a matching Deny policy is found at any level (Organization, Folder, or Project), evaluation stops and access is immediately denied.
Google Cloud IAM evaluates Deny rules first to ensure security guardrails override any permissive Allow rules.
2
Evaluate Allow policies starting at the Organization level
Permissions granted at the Organization node inherit down to all folders, projects, and resources.
IAM uses additive inheritance down the resource hierarchy starting from the root node.
3
Evaluate Allow policies at Folder and Project levels
Permissions granted at Folder and Project levels add to the inherited permissions evaluated from parent nodes.
Child nodes inherit parent permissions, and child policy bindings add additional permissions to the principal's effective access.
4
Evaluate Allow policies directly attached to the target resource
Resource-level policies are inspected to determine if explicit permissions exist at the resource level.
Some GCP resources support fine-grained IAM policies attached directly to individual resource instances.
5
Synthesize accumulated permissions and emit the final authorization decision
Access is granted if any Allow policy matched; otherwise, access is blocked by implicit deny.
IAM operates on a default-deny model where access requires at least one explicit Allow binding.

Key Concept

Google Cloud IAM Policy Evaluation Logic and Resource Hierarchy Inheritance
Rate this question

Topics

Identity and Access Management (IAM) Roles and Resource Hierarchy