Examkin

Soru

Zorluk: ZorManaging IAM Roles and Permissions

An organization is configuring access for an automated data pipeline in a Google Cloud project named `analytics-prod`. A dedicated service account used by a Cloud Run service requires read access to objects stored in a specific Cloud Storage bucket named `raw-data-vault`. Simultaneously, a data analyst requires access to create query jobs and view table data within BigQuery in the `analytics-prod` project. Security policies mandate strict adherence to the principle of least privilege while preventing unnecessary permission inheritance across the resource hierarchy. Which TWO IAM role assignments should the cloud engineer configure?

  1. Grant the service account the Storage Object Viewer role (`roles/storage.objectViewer`) bound directly on the `raw-data-vault` bucket.Cevap
  2. B
    Grant the service account the Storage Object Viewer role (`roles/storage.objectViewer`) at the parent Organization level.
  3. Grant the data analyst the BigQuery Data Viewer (`roles/bigquery.dataViewer`) and BigQuery Job User (`roles/bigquery.jobUser`) roles on the `analytics-prod` project.Cevap
  4. D
    Grant the data analyst the Editor primitive role (`roles/editor`) on the `analytics-prod` project.

Cevap

Grant the service account the Storage Object Viewer role (`roles/storage.objectViewer`) bound directly on the `raw-data-vault` bucket, and grant the data analyst the BigQuery Data Viewer (`roles/bigquery.dataViewer`) and BigQuery Job User (`roles/bigquery.jobUser`) roles on the `analytics-prod` project.
To comply with the principle of least privilege, permissions should be granted at the narrowest relevant resource scope using predefined roles tailored to specific tasks. Binding the Storage Object Viewer role directly to the specific bucket limits the service account's read access strictly to objects in that bucket. Combining BigQuery Data Viewer and BigQuery Job User at the project level provides the analyst with exact rights to run queries and view data without broader project modification capabilities.

Adım Adım Çözüm

1
Evaluate the access requirement for the Cloud Run service account.
The service account needs read-only access to objects inside a single bucket (`raw-data-vault`).
Applying `roles/storage.objectViewer` at the resource level (bucket) restricts access to only that specific bucket rather than all buckets in the project or organization.
2
Evaluate the access requirement for the data analyst.
The analyst needs to execute BigQuery queries and inspect dataset tables within `analytics-prod`.
Predefined roles `roles/bigquery.dataViewer` (for table data read) and `roles/bigquery.jobUser` (for running query jobs) satisfy these needs without over-granting project-wide administrative rights.
3
Filter out over-scoped roles and improper hierarchy bindings.
Reject assigning roles at the Organization level and reject broad primitive roles like Editor.
Hierarchy inheritance propagates higher-level bindings downwards, and primitive roles grant excessively wide permissions.

Anahtar Kavram

Applying Least Privilege IAM Role Scope and Predefined Roles
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru