A cloud security auditor requires read-only visibility into all cloud resources contained within a specific business unit's folder. An IT administrator grants the auditor the Viewer role (roles/viewer) directly on that folder. Which statement correctly describes the outcome of this role assignment across the resource hierarchy?
- The auditor automatically inherits read-only access to all current and future projects contained within that folder.Cevap
- BThe auditor receives read-only access to the folder metadata but must be granted permissions separately on each child project.
- CThe auditor must be assigned the broad primitive Owner role at the Organization level for folder permissions to propagate downward.
- DThe folder-level permission assignment fails because IAM roles can only be granted at the individual project or resource level.
Cevap
The auditor automatically inherits read-only access to all current and future projects contained within that folder.
In Google Cloud, IAM policies follow a strict top-down inheritance model across the resource hierarchy (Organization -> Folder -> Project -> Resource). Granting an IAM role at the folder level ensures that any existing or newly created child projects inside that folder automatically inherit the associated permissions.
Adım Adım Çözüm
Anahtar Kavram
Resource Hierarchy IAM Policy Inheritance