A logistics enterprise manages its Google Cloud environment using a parent folder named 'Fleet-Operations', which contains separate sub-folders for 'Production', 'Staging', and 'Development' environments. The operational safety engineering team requires read-only visibility into Compute Engine Virtual Machines (VMs) across all workloads under 'Fleet-Operations' to inspect instance configurations and operational metrics without modifying running instances or viewing object storage data. Which administrative action adheres to the principle of least privilege while minimizing operational complexity?
- Grant the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group on the 'Fleet-Operations' folder node.Cevap
- BGrant the primitive Editor role (roles/editor) to the safety engineering group on the 'Fleet-Operations' folder node.
- CGrant the Service Account Admin role (roles/iam.serviceAccountAdmin) to the safety engineering group individually inside every project under the sub-folders.
- DGrant the Storage Admin role (roles/storage.admin) to the safety engineering group on the Organization node to enable complete system visibility.
Cevap
Granting the predefined Compute Viewer role (roles/compute.viewer) to the safety engineering group at the 'Fleet-Operations' folder node.
Assigning the predefined Compute Viewer role at the top parent folder node leverages resource hierarchy inheritance. All current and future projects beneath the 'Fleet-Operations' folder automatically inherit read-only access to Compute Engine resources without giving access to modify resources or inspect object storage payload data.
Adım Adım Çözüm
Anahtar Kavram
Resource Hierarchy IAM Role Inheritance and Predefined Roles