A DevOps team is setting up access controls for a company's cloud infrastructure. An internal compliance auditing group needs to inspect security configurations and IAM policies across all projects contained within a dedicated folder named `financial-services`. Additionally, an automated deployment pipeline service account requires permissions to create and manage Compute Engine instances exclusively inside a single project named `staging-workloads`. Which of the following IAM role assignments adhere to the principle of least privilege and proper resource hierarchy scoping? (Select TWO correct answers.)
- Grant the Security Reviewer role (roles/iam.securityReviewer) to the compliance auditing group at the folder level for `financial-services`.Cevap
- Grant the Compute Admin role (roles/compute.admin) to the deployment pipeline service account at the project level for `staging-workloads`.Cevap
- CGrant the primitive Viewer role (roles/viewer) to the compliance auditing group at the Organization level.
- DGrant the primitive Editor role (roles/editor) to the deployment pipeline service account at the folder level for `financial-services`.
Cevap
The correct role assignments are granting the Security Reviewer role to the compliance auditing group at the folder level, and granting the Compute Admin role to the deployment pipeline service account at the specific project level.
Google Cloud IAM security best practices mandate using predefined roles over primitive roles to adhere to the principle of least privilege. Assigning the Security Reviewer role at the folder level grants the compliance team precise read-only security visibility for all projects in that folder. Assigning the Compute Admin role at the project level ensures the deployment pipeline can manage Compute Engine resources exclusively within the designated staging project.
Adım Adım Çözüm
Anahtar Kavram
Applying least-privilege access using predefined IAM roles at appropriate levels of the Google Cloud resource hierarchy.