Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

A DevOps engineer needs to grant a CI/CD service account permission to push container images to a single specific Artifact Registry repository within the project `prod-apps-123`. Following the principle of least privilege, the service account must be allowed to write artifacts to this repository without permissions to delete artifacts, alter repository administrative settings, or gain access to other repositories in the organization hierarchy. Which IAM configuration should the engineer apply?

  1. Assign the Artifact Registry Writer (`roles/artifactregistry.writer`) role to the service account bound directly to the target Artifact Registry repository resource.Cevap
  2. B
    Assign the Editor (`roles/editor`) primitive role to the service account at the project level.
  3. C
    Assign the Artifact Registry Repository Administrator (`roles/artifactregistry.repoAdmin`) role to the service account at the organization level.
  4. D
    Assign the Artifact Registry Writer (`roles/artifactregistry.writer`) role to the service account at the parent folder level containing the project.

Cevap

Assign the Artifact Registry Writer role (`roles/artifactregistry.writer`) directly on the specific Artifact Registry repository resource.
Assigning the predefined Artifact Registry Writer role (`roles/artifactregistry.writer`) directly on the specific Artifact Registry repository satisfies the exact functional requirements while enforcing both least role privilege and narrowest resource scope.

Adım Adım Çözüm

1
Identify the required permissions needed for pushing container images.
The predefined role Artifact Registry Writer (`roles/artifactregistry.writer`) provides read and write permissions for artifacts without delete or repository admin permissions.
Selecting a predefined role over a broad primitive role enforces least privilege functionality.
2
Determine the narrowest resource scope for the binding.
Binding the role at the specific repository resource level limits permissions strictly to that single repository.
IAM roles configured higher in the hierarchy (project, folder, or organization) inherit down to all child resources, violating least privilege.

Anahtar Kavram

Applying least privilege by combining predefined roles with precise resource-level IAM bindings.
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru