Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM) Roles and Resource Hierarchy

A telemetry platform company manages multiple environment folders (`Production`, `Development`) under a single Google Cloud Organization node. The security team needs to grant a deployment service account residing in a dedicated `Tools` project the exact permissions required to attach a workload-specific service account located in the `Production` project to newly created Compute Engine instances. The security team must enforce the principle of least privilege and ensure the deployment service account cannot modify IAM policies or create keys for the target service account. Which configuration should the security architect recommend?

  1. Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the deployment service account directly on the target workload service account resource in the Production project.Cevap
  2. B
    Grant the Service Account Admin role (`roles/iam.serviceAccountAdmin`) to the deployment service account at the Production project level.
  3. C
    Grant the Editor primitive role (`roles/editor`) to the deployment service account on the Production folder level.
  4. D
    Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the deployment service account at the Organization node level, relying on IAM policy evaluation alone to prevent unauthorized data access.

Cevap

Grant the Service Account User role (`roles/iam.serviceAccountUser`) to the deployment service account directly on the target workload service account resource in the Production project.
Granting `roles/iam.serviceAccountUser` specifically on the target workload service account resource allows the deployment service account to attach the service account to Compute Engine instances without granting any permissions over other service accounts or broader project resources.

Adım Adım Çözüm

1
Identify the minimal permission needed for attaching a service account to a compute instance.
The necessary IAM permission is `iam.serviceAccounts.actAs`, which is included in the `roles/iam.serviceAccountUser` predefined role.
Compute Engine instances require the deploying identity to possess `actAs` permission on the service account assigned to the instance.
2
Determine the optimal resource hierarchy level for binding the IAM role.
Binding the role directly on the individual service account resource rather than at the project, folder, or organization level limits access strictly to the intended target.
IAM permissions inherit down the resource hierarchy; applying access at the resource level enforces the principle of least privilege.
3
Verify that administrative capabilities are excluded.
The `Service Account User` role does not permit modifying IAM policies or creating service account keys, fulfilling the operational requirements.
Administrative rights over service accounts require separate roles such as `roles/iam.serviceAccountAdmin` or `roles/iam.serviceAccountKeyAdmin`.

Anahtar Kavram

Identity and Access Management (IAM) Service Account Impersonation and Resource Hierarchy Scope
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy