Google Associate Cloud Engineer Question 13
Single answerGoogle Cloud PlatformAs a Google Certified Associate Cloud Engineer, you have been asked to grant a new developer access to resources within a Google Cloud project. The developer needs the ability to deploy and manage applications on Google Kubernetes Engine (GKE), but should not have the ability to modify IAM policies. Which IAM role should you assign to this developer?
- A
Kubernetes Engine Admin
- B
Kubernetes Engine Developer
- C
Project Editor
- D
Kubernetes Engine Viewer
Show answer and explanation
Correct answer: B
Explanation
The Kubernetes Engine Developer role grants the necessary permissions to deploy and manage applications on Google Kubernetes Engine without granting permissions to modify IAM policies. This aligns with the requirement to restrict the developer's ability to change IAM settings while allowing them to work with GKE.
- A. Incorrect.
Kubernetes Engine Admin role allows full access to manage all Kubernetes resources, including IAM policies. It exceeds the required permissions.
- B. Correct.
Kubernetes Engine Developer role allows for deploying and managing applications on GKE without permissions to modify IAM policies, making it suitable for the scenario.
- C. Incorrect.
Project Editor role provides broad permissions across the project, including the ability to modify IAM policies, which is not suitable for the requirement.
- D. Incorrect.
Kubernetes Engine Viewer role only allows viewing of GKE resources, not deploying or managing applications.