Examkin

Soru

Zorluk: KolayManaging IAM Roles and Resource Access Permissions

You need to grant a developer access to view and download objects stored within a specific Cloud Storage bucket in your project. Following Google Cloud best practices and the principle of least privilege, which IAM role should you assign?

  1. Storage Object Viewer (roles/storage.objectViewer)Cevap
  2. B
    Viewer (roles/viewer)
  3. C
    Editor (roles/editor)
  4. D
    Billing Account Viewer (roles/billing.viewer)

Cevap

The correct role is Storage Object Viewer (roles/storage.objectViewer).
The Storage Object Viewer role (roles/storage.objectViewer) grants read-only access to storage objects within Cloud Storage. Predefined roles are recommended by Google Cloud because they follow the principle of least privilege by providing only the permissions necessary for the specific task.

Adım Adım Çözüm

1
Identify the required operational task
The user needs to view and download objects from a Cloud Storage bucket.
Understanding the precise permissions needed is essential for adhering to least privilege access.
2
Evaluate role types following GCP best practices
Avoid primitive roles (Viewer, Editor, Owner) when specific predefined roles exist.
Primitive roles grant broad access to almost all GCP services in the project, whereas predefined roles scope permissions down to specific service tasks.
3
Select the appropriate predefined IAM role
Storage Object Viewer provides permissions to read and list bucket objects specifically.
This grants exactly the required permissions without unnecessary administrative privileges.

Anahtar Kavram

Principle of Least Privilege using Predefined IAM Roles
Tahmini Süre:45s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru