Examkin

Soru

Zorluk: ZorIdentity and Access Management (IAM) Roles and Resource Hierarchy

A global logistics firm structures its Google Cloud environment using an Organization node with folders for separate business units, including a top-level folder named 'FleetManagement'. A telemetry processing workload running on Compute Engine instances within a specific project under 'FleetManagement' requires reading telemetry data files from Cloud Storage buckets across all current and future projects within the 'FleetManagement' folder tree. Additionally, the application must sign Cloud Storage URL tokens for short-lived downstream download access without possessing administrative permissions over IAM policies or resource configurations. Which access control design best satisfies these requirements while strictly adhering to the principle of least privilege?

  1. Bind the predefined role Storage Object Viewer (roles/storage.objectViewer) to the telemetry workload's service account at the 'FleetManagement' folder level, and grant the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the workload's service account to itself.Cevap
  2. B
    Bind the primitive Viewer role (roles/viewer) to the telemetry workload's service account at the Organization node level so that all present and future Cloud Storage buckets across the entire company are accessible for object reading and signing.
  3. C
    Bind the Service Account Admin role (roles/iam.serviceAccountAdmin) to the workload service account at the 'FleetManagement' folder level so it can create and manage its own encryption keys and tokens for signing Cloud Storage URLs.
  4. D
    Bind the Storage Object Admin role (roles/storage.objectAdmin) at the individual project level for each project in 'FleetManagement', relying strictly on IAM permission boundaries to prevent unauthorized data exfiltration.

Cevap

Grant the predefined Storage Object Viewer role at the 'FleetManagement' folder level and assign the Service Account Token Creator role directly on the workload's service account.
Binding the Storage Object Viewer role at the folder level leverages resource hierarchy inheritance so that all current and future projects beneath the 'FleetManagement' folder automatically grant read access to storage objects. Additionally, granting the Service Account Token Creator role directly on the service account identity allows the application to call the signBlob API and generate signed URLs for secure downstream access while satisfying the principle of least privilege.

Adım Adım Çözüm

1
Determine the optimal resource hierarchy scope for permission inheritance
Binding permissions at the 'FleetManagement' folder level ensures all nested projects automatically inherit read access without per-project maintenance overhead.
Google Cloud IAM policy evaluation unions permissions top-down through the resource hierarchy.
2
Select fine-grained predefined roles over primitive or administrative roles
Storage Object Viewer (roles/storage.objectViewer) grants read-only access to storage objects without allowing modification or deletion.
Primitive roles like Viewer or administrative roles like Storage Object Admin violate least privilege.
3
Configure permissions for generating signed URLs
Assigning Service Account Token Creator (roles/iam.serviceAccountTokenCreator) on the identity resource enables blob signing without granting full service account management rights.
Service Account Admin grants unnecessary full administrative permissions over service accounts.

Anahtar Kavram

Resource hierarchy IAM inheritance and targeted service account impersonation/token creation roles.
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy