Google Associate Cloud Engineer Question 335
Select 2Google Cloud PlatformAs a Google Cloud Associate Cloud Engineer, you are tasked with granting a new developer read access to a specific Cloud Storage bucket. Which of the following steps should you perform to achieve this using IAM policies?
- A
Navigate to the IAM & Admin section in the Google Cloud Console and add the developer's email with the 'Storage Object Viewer' role.
- B
Use the 'gsutil' command-line tool to create a new IAM policy and assign the 'Storage Admin' role to the developer.
- C
In the Google Cloud Console, go to the Cloud Storage section, select the bucket, and add a bucket-level IAM policy granting the 'Storage Object Viewer' role to the developer.
- D
Write a custom IAM policy in JSON format and apply it directly to the developer's account under the IAM roles section.
- E
Navigate to the IAM & Admin section in the Google Cloud Console and add the developer's email with the 'Viewer' role.
Show answer and explanation
Correct answers: A, C
Explanation
To grant read access to a specific Cloud Storage bucket, you can either assign a predefined role like 'Storage Object Viewer' at the project level for broad access or apply a bucket-level IAM policy for more granular control. Option 1 is a valid method for applying a role at the project level, and Option 3 provides bucket-specific access, both of which are suitable for this scenario.
- A. Correct.
This is a correct step as it allows you to assign a predefined role at the project level, which includes permissions for viewing objects in all Cloud Storage buckets within the project.
- B. Incorrect.
Assigning the 'Storage Admin' role grants more permissions than necessary for read access, including the ability to create, delete, and modify buckets and objects.
- C. Correct.
This option is correct as it involves setting a bucket-level policy, which directly applies to the specific bucket and grants the necessary read permissions.
- D. Incorrect.
Custom IAM policies are not typically crafted in JSON directly in the console for such straightforward tasks, and there is no direct role application in this manner.
- E. Incorrect.
The 'Viewer' role at the project level does not include permissions specific to Cloud Storage buckets. It is a broader role and not specific for the given task.