Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

A cloud operations team needs to grant a newly assigned developer permissions to deploy, update, and manage Cloud Functions within a target project named `backend-api-884`. The developer must not be granted permissions to modify other infrastructure components in the project, nor should their permissions extend to any other projects within the resource hierarchy. Which IAM role assignment adheres strictly to the principle of least privilege?

  1. Assign the Cloud Functions Admin role (`roles/cloudfunctions.admin`) on the `backend-api-884` project.Cevap
  2. B
    Assign the Editor role (`roles/editor`) on the `backend-api-884` project.
  3. C
    Assign the Cloud Functions Admin role (`roles/cloudfunctions.admin`) on the parent Folder containing `backend-api-884`.
  4. D
    Assign the Owner role (`roles/owner`) on the `backend-api-884` project.

Cevap

Assign the Cloud Functions Admin role (`roles/cloudfunctions.admin`) on the `backend-api-884` project.
Assigning the predefined Cloud Functions Admin role at the project level restricts administrative capabilities strictly to Cloud Functions and scopes those permissions solely to the targeted project (`backend-api-884`), satisfying the principle of least privilege.

Adım Adım Çözüm

1
Identify the required functional capabilities.
The user needs to create, update, and manage Cloud Functions specifically.
Determining the required task bounds allows choosing a predefined role rather than a broad primitive role.
2
Select the appropriate IAM role using least privilege principles.
The Cloud Functions Admin role (`roles/cloudfunctions.admin`) provides full control over Cloud Functions without granting access to unrelated services like Compute Engine or VPC networks.
Predefined service-specific roles adhere to least privilege better than primitive roles (Owner, Editor, Viewer).
3
Determine the minimal required resource hierarchy scope.
Bind the role at the specific project resource node (`backend-api-884`).
Assigning permissions at the project level prevents accidental permission inheritance to other projects contained within parent folders or the organization.

Anahtar Kavram

Principle of Least Privilege with Predefined Roles and Resource Scope
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru