An Associate Cloud Engineer needs to configure granular access controls for an automated deployment service account by creating a new project-level custom IAM role and granting it to the service account. Which sequence of steps represents the correct procedure to implement this using the gcloud command-line tool?
- 1Define the custom IAM role properties, including title, description, launch stage, and specific permissions, inside a local YAML file.
- 2Execute `gcloud iam roles create` referencing the project ID and the local YAML file to instantiate the custom role.
- 3Run `gcloud iam roles describe` with the project custom role name to verify the role state and assigned permission list.
- 4Execute `gcloud projects add-iam-policy-binding` specifying the project ID, the service account principal, and the full custom role ID.
Cevap
The correct operational order is: First, define the custom role properties in a local YAML configuration file. Second, create the project-level custom role using `gcloud iam roles create`. Third, verify the created role details with `gcloud iam roles describe`. Fourth, assign the custom role to the target service account using `gcloud projects add-iam-policy-binding`.
Creating and applying a custom IAM role requires a strict workflow: first defining the permission schema in a file, creating the role resource at the desired level of the hierarchy using `gcloud iam roles create`, validating the resource via `gcloud iam roles describe`, and lastly modifying the resource's IAM policy binding to attach the role to the principal via `gcloud projects add-iam-policy-binding`.
Adım Adım Çözüm
Anahtar Kavram
Custom IAM Role Creation and Policy Binding Lifecycle