A security auditing team requires access to run SQL queries and analyze table data within a specific BigQuery dataset in the project `finance-analytics-prod`. The team must be able to execute jobs in the project, but company security policy mandates strict adherence to the principle of least privilege, prohibiting the use of primitive roles or broad administrative privileges. Which TWO actions should you perform to grant the minimum required access? (Select TWO.)
- Grant the BigQuery Job User (roles/bigquery.jobUser) role to the auditing team at the project level.Cevap
- Grant the BigQuery Data Viewer (roles/bigquery.dataViewer) role to the auditing team at the dataset level.Cevap
- CGrant the Editor (roles/editor) role to the auditing team at the project level.
- DGrant the Billing Account User (roles/billing.user) role to the auditing team on the project's linked billing account.
Cevap
Grant the BigQuery Job User role to the team at the project level, and grant the BigQuery Data Viewer role to the team at the specific dataset level.
To execute BigQuery queries and read table data securely under the principle of least privilege, two separate predefined roles are required: the BigQuery Job User role assigned at the project level to allow job running, and the BigQuery Data Viewer role assigned specifically on the target dataset to permit data reading.
Adım Adım Çözüm
Anahtar Kavram
Combining resource-level and project-level predefined IAM roles to enforce the principle of least privilege in Google Cloud.
Tahmini Süre:2m 0s