An enterprise financial company uses a Google Cloud Organization hierarchy containing a parent folder named `Financial-Core-Prod` that holds multiple production projects. The security team needs to grant an external compliance audit firm read-only access to view infrastructure resource configurations, security policies, and IAM bindings across all present and future projects within `Financial-Core-Prod`. The audit firm must not have access to view underlying data inside Cloud Storage buckets or modify any resource configurations. Which IAM assignment strategy meets these requirements while adhering to Google Cloud best practices for resource hierarchy and least privilege?
- Grant the predefined `roles/iam.securityReviewer` role to the audit firm's Google Group at the `Financial-Core-Prod` folder level.Cevap
- BGrant the primitive `roles/viewer` role to the audit firm's Google Group at the `Financial-Core-Prod` folder level.
- CCreate a dedicated audit service account, grant it `roles/iam.serviceAccountAdmin` at the Organization level, and download service account keys for the auditors.
- DGrant `roles/editor` to the auditors on each project individually and rely on VPC Service Controls perimeters to block data exfiltration.
Cevap
Grant the predefined role Security Reviewer (roles/iam.securityReviewer) to the auditor Google Group at the folder level.
Granting the predefined Security Reviewer role (`roles/iam.securityReviewer`) to a Google Group at the folder level leverages resource hierarchy inheritance. All current and future projects beneath that folder inherit the policy, allowing auditors to inspect security configurations and resource metadata across the environment without accessing object data or requiring broad primitive roles.
Adım Adım Çözüm
Anahtar Kavram
Resource Hierarchy Permission Inheritance and Predefined IAM Roles