Examkin

Soru

Zorluk: OrtaEnabling and Managing Cloud Service APIs

A cloud engineer is configuring a dedicated deployment service account that will automate project setup. The service account needs to enable and disable Google Cloud APIs (such as Compute Engine API and Cloud Run API) within a targeted project named `app-deploy-prod`. Following Google Cloud best practices for the principle of least privilege, which predefined IAM role should be assigned to the service account on the `app-deploy-prod` project?

  1. Service Usage Admin (roles/serviceusage.serviceUsageAdmin)Cevap
  2. B
    Editor (roles/editor)
  3. C
    Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)
  4. D
    Organization Admin (roles/resourcemanager.organizationAdmin)

Cevap

Service Usage Admin (roles/serviceusage.serviceUsageAdmin)
The Service Usage Admin (`roles/serviceusage.serviceUsageAdmin`) role grants full administrative access to enable, disable, inspect, and audit service usage and APIs within a target project while upholding the principle of least privilege.

Adım Adım Çözüm

1
Identify the required functional capability
The requirement asks for enabling and disabling Cloud Service APIs within a target project.
API administration requires specific `serviceusage.services.enable` and `serviceusage.services.disable` permissions.
2
Evaluate candidate IAM roles against the Principle of Least Privilege
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) contains the exact permissions needed to enable and disable service APIs without granting broader resource modification capabilities.
Primitive roles like Editor or high-level resource manager roles like Organization Admin grant excessive permissions.

Anahtar Kavram

Enabling Cloud Service APIs using Predefined IAM Roles and Least Privilege
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru