Examkin

Soru

Zorluk: OrtaManaging IAM Roles and Permissions

A DevOps team needs to grant a newly onboarded service account permissions to deploy and manage Cloud Run services within project `proj-staging-101`, as well as read build artifacts stored inside a specific Cloud Storage bucket named `bkt-staging-artifacts-99`. To adhere strictly to the Principle of Least Privilege without granting unnecessary permissions across other resources or projects, which TWO IAM role assignments should the team configure?

  1. Grant Cloud Run Developer (`roles/run.developer`) on project `proj-staging-101`.Cevap
  2. Grant Storage Object Viewer (`roles/storage.objectViewer`) directly on the `bkt-staging-artifacts-99` bucket.Cevap
  3. C
    Grant Editor (`roles/editor`) on project `proj-staging-101`.
  4. D
    Grant Storage Object Viewer (`roles/storage.objectViewer`) at the Folder level containing project `proj-staging-101`.

Cevap

Assign Cloud Run Developer (roles/run.developer) at the project level and Storage Object Viewer (roles/storage.objectViewer) directly on the specific Cloud Storage bucket.
Combining the predefined Cloud Run Developer role at the project level with the Storage Object Viewer role restricted to the targeted bucket provides the exact capabilities required while avoiding excessive permissions across other services or projects.

Adım Adım Çözüm

1
Identify the minimal role required for Cloud Run management.
Cloud Run Developer (roles/run.developer) provides service management rights without broad administrative access.
Predefined roles are preferred over primitive roles (such as Editor) to follow the Principle of Least Privilege.
2
Identify the narrowest resource boundary for Cloud Storage access.
Applying Storage Object Viewer at the bucket resource scope limits access exclusively to `bkt-staging-artifacts-99`.
Assigning roles higher up in the resource hierarchy (such as at the Folder level) causes downstream inheritance across unintended projects and buckets.

Anahtar Kavram

Applying Least Privilege using Predefined Roles and Resource-Level IAM Bindings
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Managing IAM Roles and Permissions

Bu konudan daha fazla soru