Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

A background data processing pipeline requires access to send telemetry events to Cloud Pub/Sub topics located within a dedicated analytics project. The service account assigned to the pipeline should only have permissions to publish messages, without the ability to create topics, read messages from subscriptions, or alter topic configurations. To adhere to the principle of least privilege, which IAM role configuration should be applied to the service account?

  1. Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.Cevap
  2. B
    Grant the Editor (roles/editor) role at the project level.
  3. C
    Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the organization level.
  4. D
    Grant the Pub/Sub Admin (roles/pubsub.admin) role at the project level.

Cevap

Grant the Pub/Sub Publisher (roles/pubsub.publisher) role at the project level.
Granting the predefined Pub/Sub Publisher role at the project level satisfies the principle of least privilege by providing only the permissions needed to publish messages within the designated project, preventing excessive access to non-required actions or other projects.

Adım Adım Çözüm

1
Identify the required permissions based on operational needs.
The pipeline requires only message publishing capability (pubsub.topics.publish).
Least privilege mandates granting only permissions essential for the workload.
2
Select the appropriate IAM role type.
Select the predefined role 'roles/pubsub.publisher' instead of primitive roles or overly broad admin predefined roles.
Predefined roles provide fine-grained permissions tailored to specific job functions.
3
Determine the minimum resource hierarchy scope.
Apply the role binding at the project level containing the Pub/Sub topics.
Binding at higher levels (Organization or Folder) inherits downstream and grants unnecessary access across other projects.

Anahtar Kavram

Principle of Least Privilege and Resource Hierarchy Scoping in GCP IAM
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru