An enterprise architecture team is setting up access control for a newly deployed microservice in Google Cloud Project `prod-analytics-v2`. A third-party security auditing team needs to review IAM policy bindings and configuration settings for Cloud Pub/Sub topics and Cloud Storage buckets without viewing payload data or modifying resources. Additionally, an external deployment service account needs to deploy new revisions to Cloud Run services within the project without receiving permissions to modify project IAM policies or create new Cloud Storage buckets. Which of the following IAM role assignments adhere to the principle of least privilege to satisfy these security requirements? (Select TWO.)
- Grant the Security Reviewer role (`roles/iam.securityReviewer`) at the project level to the security auditing team.Cevap
- Grant the Cloud Run Developer role (`roles/run.developer`) at the project level to the external deployment service account.Cevap
- CGrant the Editor primitive role (`roles/editor`) at the project level to the deployment service account to ensure deployment actions succeed.
- DGrant the Security Reviewer role (`roles/iam.securityReviewer`) at the parent Folder level containing `prod-analytics-v2`.
Cevap
Granting the Security Reviewer role at the project level to the auditing team and granting the Cloud Run Developer role at the project level to the deployment service account.
To satisfy least-privilege security requirements, predefined roles should be used instead of primitive roles, and permissions should be scoped precisely to the targeted project rather than parent folders or organization nodes. The Security Reviewer role allows reading security policies and configuration metadata without exposing application payload data. The Cloud Run Developer role allows creating and updating Cloud Run revisions without granting broad project administration permissions.
Adım Adım Çözüm
Anahtar Kavram
Applying Least Privilege via Predefined Roles and Project Resource Scope