Examkin

Soru

Zorluk: KolayManaging IAM Roles and Permissions

A software engineer needs to upload container images to Google Artifact Registry repositories within a development project. Following the principle of least privilege, which IAM role should you grant to the engineer?

  1. Artifact Registry Writer (`roles/artifactregistry.writer`) on the projectCevap
  2. B
    Editor (`roles/editor`) on the project
  3. C
    Artifact Registry Administrator (`roles/artifactregistry.admin`) at the Organization level
  4. D
    Owner (`roles/owner`) on the project

Cevap

Grant the Artifact Registry Writer role (`roles/artifactregistry.writer`) scoped to the specific project.
The Artifact Registry Writer role (`roles/artifactregistry.writer`) provides permissions to read and write repositories, which enables pushing container images. Granting this predefined role at the project level meets the functional requirement while adhering strictly to the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operational permission
The engineer specifically needs permission to upload (push) container images to Artifact Registry repositories.
Understanding the precise capability needed allows selecting the narrowest matching IAM role.
2
Apply the Principle of Least Privilege
Select the predefined role `roles/artifactregistry.writer` over broad primitive roles or administrative predefined roles.
Predefined roles provide targeted permissions for specific service actions without exposing administrative capabilities or other GCP services.
3
Scope the role binding appropriately
Bind the role at the target project level rather than higher up in the resource hierarchy.
IAM roles inherit down the resource hierarchy; granting access at the project level restricts access to resources within that project.

Anahtar Kavram

Selecting specific Predefined Roles over broad Primitive Roles to satisfy the Principle of Least Privilege.
Tahmini Süre:45s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru