A Google Cloud Security Architect is documenting how IAM permissions are evaluated for a principal requesting access to a Cloud Storage bucket inside a multi-tier folder environment. Arrange the resource hierarchy levels in the correct order of policy evaluation and inheritance, starting from the root parent node down to the individual target resource.
- 1Organization node IAM policy evaluation
- 2Folder node IAM policy evaluation
- 3Project node IAM policy evaluation
- 4Resource-level (Cloud Storage bucket) IAM policy evaluation
Answer
The correct order of IAM policy evaluation across the Google Cloud resource hierarchy starts at the Organization node, descends through the Folder node, proceeds to the Project node, and finishes at the Resource-level (Cloud Storage bucket).
In Google Cloud, IAM access policy evaluation follows the strict top-down structure of the resource hierarchy: Organization -> Folder -> Project -> Resource. Permissions granted at higher nodes inherit downward and accumulate, determining the effective access granted to a principal.
Step-by-Step Solution
Key Concept
Google Cloud IAM permissions are inherited down the resource hierarchy (Organization -> Folder -> Project -> Resource). Permissions are additive, meaning access granted at a higher level cannot be denied or restricted at a lower child level.