An organization is configuring IAM access for an automated CI/CD pipeline service account. The service account must submit build tasks via Cloud Build and deploy updated code to Cloud Functions within the project `app-backend-prod`. The access must strictly adhere to the Principle of Least Privilege without extending rights to other projects or granting administrative control over unrelated services. Which TWO role bindings should be assigned to the service account? (Select TWO)
- Grant Cloud Build Editor (`roles/cloudbuild.builds.editor`) on the `app-backend-prod` project.Cevap
- Grant Cloud Functions Developer (`roles/cloudfunctions.developer`) on the `app-backend-prod` project.Cevap
- CGrant Editor (`roles/editor`) at the parent Folder level containing `app-backend-prod`.
- DGrant Viewer (`roles/viewer`) at the Organization resource level.
Cevap
To enforce least privilege, the service account must be granted specific predefined roles (Cloud Build Editor and Cloud Functions Developer) bounded strictly to the target project level (`app-backend-prod`), rather than primitive roles or higher-level folder/organization bindings.
Granting Cloud Build Editor and Cloud Functions Developer directly on the target project provides exact permissions for build execution and function deployment without over-granting rights.
Adım Adım Çözüm
Anahtar Kavram
Applying least-privilege predefined IAM roles at the narrowest appropriate scope in the Google Cloud resource hierarchy.