An organization's security compliance team needs to audit Google Cloud Pub/Sub resource configurations and inspect subscription metrics across all projects inside a designated Folder. However, compliance policies strictly prohibit the team from viewing or pulling actual Pub/Sub message payloads. Following Google Cloud recommended best practices and the principle of least privilege, which TWO predefined IAM roles should be granted to the security compliance team at the Folder level?
- Pub/Sub Viewer (roles/pubsub.viewer)Cevap
- Monitoring Viewer (roles/monitoring.viewer)Cevap
- CPub/Sub Subscriber (roles/pubsub.subscriber)
- DEditor (roles/editor)
Cevap
The correct roles to grant are Pub/Sub Viewer (roles/pubsub.viewer) and Monitoring Viewer (roles/monitoring.viewer).
To satisfy the audit requirements under the principle of least privilege, the compliance team requires two distinct capabilities: metadata visibility for Pub/Sub resources and read access to monitoring metrics. The Pub/Sub Viewer role allows inspecting topics, subscriptions, and configurations without granting message pulling permissions. The Monitoring Viewer role provides access to view metrics such as backlog sizes and message throughput in Cloud Monitoring. Inherited at the Folder level, these two predefined roles provide full folder-wide compliance auditing while protecting payload privacy.
Adım Adım Çözüm
Anahtar Kavram
Selecting predefined IAM roles for resource metadata and monitoring under the principle of least privilege.