An enterprise cloud security architect is documenting how Google Cloud IAM calculates effective access permissions when a service account attempts to read an object stored in a Cloud Storage bucket. Arrange the steps of the IAM policy evaluation process in the correct chronological order from initial API request submission to the final access determination.
- 1The service account issues an authenticated API request targeting the specific Cloud Storage object.
- 2IAM evaluates policy bindings attached at the Organization root level.
- 3IAM evaluates inherited policy bindings attached along the Folder hierarchy path.
- 4IAM evaluates policy bindings defined directly on the hosting Project node.
- 5IAM evaluates resource-level IAM policies on the bucket and calculates the union of all granted permissions to issue an access decision.
Cevap
The correct sequence evaluates IAM permissions top-down along the resource hierarchy: Request initiation -> Organization root evaluation -> Folder hierarchy evaluation -> Project level evaluation -> Resource policy evaluation and final union calculation.
Google Cloud IAM evaluates permissions top-down starting from the API request receipt, proceeding from the Organization root down through Folders, Project, and finally Resource-level policies. Effective access is determined by combining all permissions granted along the hierarchy path.
Adım Adım Çözüm
Anahtar Kavram
GCP IAM Resource Hierarchy Evaluation and Permission Inheritance