A cloud security administrator needs to grant an external auditing team access to view the configuration and metadata of Compute Engine virtual machine instances within a specific Google Cloud project. The auditors must not be able to start, stop, modify, or delete any instances, nor should they have access to view resources in other Google Cloud services within the project. Following Google's recommended best practice of applying the principle of least privilege, which IAM role should be assigned to the auditing team on the project?
- Compute Viewer (roles/compute.viewer)Cevap
- BViewer (roles/viewer)
- CCompute Instance Admin (v1) (roles/compute.instanceAdmin.v1)
- DEditor (roles/editor) at the project level combined with an IAM Deny Policy on Compute Engine
Cevap
Assign the Compute Viewer (roles/compute.viewer) role to the auditing team at the project level.
The Compute Viewer (roles/compute.viewer) role is a predefined role that grants read-only access to Compute Engine resources. It allows users to view virtual machine instance configurations, metadata, and status without permitting actions that modify instances (such as starting, stopping, or deleting) and without granting access to view resources in other GCP services within the project.
Adım Adım Çözüm
Anahtar Kavram
Selecting predefined IAM roles over primitive roles to adhere to the principle of least privilege.
Tahmini Süre:1m 15s