Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Resource Access Permissions

A cloud engineer needs to configure a fine-grained custom IAM role for a service account using the gcloud CLI to enforce least privilege access in a Google Cloud project. What is the correct sequence of steps to create the custom role, provision the service account, and apply the required access permissions?

  1. 1Draft a YAML file defining the custom role metadata, launch stage, and specific permissions list.
  2. 2Run `gcloud iam roles create` referencing the YAML file to register the custom role in the project.
  3. 3Run `gcloud iam service-accounts create` to provision the service account identity.
  4. 4Run `gcloud projects add-iam-policy-binding` to grant the custom role to the service account.

Cevap

The correct operational order is to draft the custom role YAML definition file, run `gcloud iam roles create` to create the role resource, run `gcloud iam service-accounts create` to provision the service account identity, and finally execute `gcloud projects add-iam-policy-binding` to assign the role to the service account.
The sequence follows mandatory resource dependencies: permissions are defined in a specification file, the custom role is registered in GCP IAM, the target service account identity is provisioned, and finally the role is bound to the identity using project policy bindings.

Adım Adım Çözüm

1
Prepare the custom IAM role definition locally in YAML format.
A structured YAML file containing title, description, stage, and allowed permissions.
The gcloud CLI requires a YAML or JSON definition file to specify custom permission sets.
2
Create the custom IAM role resource in the GCP project.
The custom role is registered and assigned a unique role ID within the project.
IAM roles must exist in the target hierarchy before policy bindings can reference them.
3
Create the service account identity.
A service account principal is initialized with a generated email identifier.
A valid principal identity must exist before IAM roles can be granted to it.
4
Bind the custom role to the service account on the project resource.
The project's IAM policy is updated to grant the specified role permissions to the service account.
Adding an IAM policy binding completes the access configuration by attaching the role to the identity.

Anahtar Kavram

Managing IAM Roles and Resource Access Permissions via gcloud CLI
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing IAM Roles and Resource Access Permissions

Bu konudan daha fazla soru