An analytics team needs to execute BigQuery SQL queries within project `proj-analytics-881` and read raw data files stored in a specific Cloud Storage bucket named `gs://raw-telemetry-2026`. The security administrator must configure access adhering strictly to the principle of least privilege. Which TWO IAM role bindings should be granted?
- Grant the BigQuery Job User role (`roles/bigquery.jobUser`) to the analytics team on project `proj-analytics-881`.Cevap
- Grant the Storage Object Viewer role (`roles/storage.objectViewer`) to the analytics team specifically on the `gs://raw-telemetry-2026` bucket.Cevap
- CGrant the Editor primitive role (`roles/editor`) to the analytics team on project `proj-analytics-881`.
- DGrant the Storage Admin role (`roles/storage.admin`) to the analytics team at the Organization level.
Cevap
Grant the BigQuery Job User role (`roles/bigquery.jobUser`) on project `proj-analytics-881` and grant the Storage Object Viewer role (`roles/storage.objectViewer`) on the specific Cloud Storage bucket `gs://raw-telemetry-2026`.
To satisfy least privilege requirements, the team should receive the BigQuery Job User role (`roles/bigquery.jobUser`) at the project level to execute queries, and the Storage Object Viewer role (`roles/storage.objectViewer`) applied directly to the designated bucket `gs://raw-telemetry-2026` to read target files without accessing other project resources.
Adım Adım Çözüm
Anahtar Kavram
Applying least privilege through predefined role selection and resource-level IAM policy bindings.