Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

An automated log-processing service account running in a GCP environment requires read-only access to source logs stored in a Cloud Storage bucket in Project Alpha (`src-logs-bucket`) and must write processed log output to a destination Cloud Storage bucket in Project Beta (`dst-logs-bucket`). Which of the following IAM role assignments adhere to the principle of least privilege while providing the necessary permissions? (Select TWO answers.)

  1. Grant Storage Object Viewer (roles/storage.objectViewer) on the source Cloud Storage bucket in Project Alpha.Cevap
  2. B
    Grant Editor (roles/editor) at the project level for both Project Alpha and Project Beta.
  3. Grant Storage Object Creator (roles/storage.objectCreator) on the destination Cloud Storage bucket in Project Beta.Cevap
  4. D
    Grant Storage Object Admin (roles/storage.objectAdmin) at the parent Organization level.

Cevap

The correct role assignments are granting Storage Object Viewer (roles/storage.objectViewer) on the source Cloud Storage bucket in Project Alpha, and granting Storage Object Creator (roles/storage.objectCreator) on the destination Cloud Storage bucket in Project Beta.
To adhere to the principle of least privilege, access must be scoped to the specific target resources and restricted to the minimum required permissions. Granting Storage Object Viewer on the source bucket in Project Alpha permits reading log files without access to other project resources. Granting Storage Object Creator on the destination bucket in Project Beta allows writing output logs without permitting reading or modifying existing objects.

Adım Adım Çözüm

1
Analyze the read requirement for the source bucket in Project Alpha.
The service account only needs to read objects in `src-logs-bucket`.
The predefined role Storage Object Viewer (`roles/storage.objectViewer`) applied directly at the bucket resource level provides read access without excess permissions.
2
Analyze the write requirement for the destination bucket in Project Beta.
The service account only needs to create new objects in `dst-logs-bucket`.
The predefined role Storage Object Creator (`roles/storage.objectCreator`) applied directly at the destination bucket level allows creating objects without providing permissions to view or delete existing data.
3
Evaluate scope and role breadth to ensure compliance with least privilege.
Resource-level bindings using specialized predefined roles avoid project-wide or organization-wide over-granting.
Granting broad primitive roles or assigning permissions at higher levels in the resource hierarchy violates Google Cloud security best practices.

Anahtar Kavram

Applying Least Privilege with Resource-Scoped Predefined IAM Roles
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru