Examkin

Soru

Zorluk: OrtaIdentity and Access Management (IAM) Roles and Resource Hierarchy

A financial analytics firm structures its Google Cloud environment with a top-level folder named `FinTech-Analytics`. Within this folder, a project named `fraud-detection-prod` runs automated risk-scoring microservices on Compute Engine. The microservices run under a dedicated application service account and must read transaction audit logs stored in a Cloud Storage bucket located inside a separate project named `compliance-data-prod` under the same folder. Furthermore, the developer team requires access to deploy and manage virtual machine instances within `fraud-detection-prod`, but must not be able to modify IAM access policies across the resource hierarchy. Which two IAM configuration steps should you take to adhere to the principle of least privilege? (Select TWO)

  1. Grant the application service account the Storage Object Viewer role (roles/storage.objectViewer) scoped directly to the audit log bucket in compliance-data-prod.Cevap
  2. B
    Grant the application service account the primitive Editor role (roles/editor) at the FinTech-Analytics folder level.
  3. Grant the developer team the Compute Instance Admin (v1) role (roles/compute.instanceAdmin.v1) on the fraud-detection-prod project.Cevap
  4. D
    Grant the developer team the Service Account Admin role (roles/iam.serviceAccountAdmin) on the fraud-detection-prod project so they can assign service accounts to new virtual machines.

Cevap

The correct architecture requires granting the Storage Object Viewer role to the application service account directly on the targeted Cloud Storage bucket in compliance-data-prod, and granting the Compute Instance Admin (v1) role to the developer team at the fraud-detection-prod project scope.
To satisfy least privilege requirements, access must be scoped to the narrowest resource boundary with predefined roles. Applying the Storage Object Viewer role directly to the specific Cloud Storage bucket in the compliance project enables cross-project object access without opening access to other resources. Assigning Compute Instance Admin (v1) at the compute project level allows developers to perform VM management without modifying IAM policies or accessing folder-level resources.

Adım Adım Çözüm

1
Determine least privilege storage access for cross-project data reading
Identify that roles/storage.objectViewer scoped to the specific Cloud Storage bucket in compliance-data-prod grants read access to objects without exposing other project resources.
IAM permissions inherit downward. Applying granular roles at the lowest resource level (bucket) prevents over-privileging across the project or folder.
2
Evaluate compute management permissions for developers
Identify that roles/compute.instanceAdmin.v1 on fraud-detection-prod provides instance lifecycle management capabilities without granting security policy or project administration permissions.
Predefined workload roles limit administrative capability to compute management rather than security control plane management.
3
Reject broad primitive roles and excessive service account administrative permissions
Avoid granting primitive roles (Editor) or administrative identity roles (Service Account Admin) when fine-grained compute administration and service account usage roles suffice.
Using primitive roles or granting Service Account Admin creates privilege escalation risks.

Anahtar Kavram

Fine-Grained Predefined IAM Roles and Resource Hierarchy Scoping
Bu soruyu puanla

Konular

Identity and Access Management (IAM) Roles and Resource Hierarchy