Examkin

Soru

Zorluk: KolayEnabling and Managing Cloud Service APIs

A DevOps team is configuring an automated script that needs to enable Google Cloud service APIs on demand across new workload projects. The script executes the command `gcloud services enable vision.googleapis.com`. Following the principle of least privilege, which predefined IAM role should be granted to the identity executing this script?

  1. Service Usage Admin (roles/serviceusage.serviceUsageAdmin)Cevap
  2. B
    Owner (roles/owner)
  3. C
    Service Usage Consumer (roles/serviceusage.serviceUsageConsumer)
  4. D
    Organization Administrator (roles/resourcemanager.organizationAdmin)

Cevap

Service Usage Admin (roles/serviceusage.serviceUsageAdmin)
The Service Usage Admin role (`roles/serviceusage.serviceUsageAdmin`) provides the exact permissions required (`serviceusage.services.enable`) to enable and manage APIs within a target Google Cloud project while adhering to the principle of least privilege.

Adım Adım Çözüm

1
Identify the required operation
The automated script needs to enable Cloud Service APIs using `gcloud services enable`.
Enabling APIs requires the specific IAM permission `serviceusage.services.enable`.
2
Evaluate roles based on the principle of least privilege
The predefined role `roles/serviceusage.serviceUsageAdmin` provides permissions to enable and disable services without granting excessive privileges over unrelated GCP resources.
Primitive roles like Owner or broad organization-level roles grant unnecessary admin access.

Anahtar Kavram

Least privilege IAM role selection for enabling Google Cloud service APIs
Bu soruyu puanla

Konular

Enabling and Managing Cloud Service APIs

Bu konudan daha fazla soru