Google Associate Cloud Engineer Question 337
Select 2Google Cloud PlatformYou are a Google Cloud Engineer tasked with granting a new team member access to manage Compute Engine instances within a specific project. Which of the following steps should you take to create an appropriate IAM policy that aligns with the principle of least privilege?
- A
Assign the 'Owner' role to the team member for the project.
- B
Create a custom role with permissions specific to Compute Engine and assign it to the team member.
- C
Grant the 'Compute Admin' role to the team member.
- D
Use the 'Viewer' role to allow read-only access to all resources in the project.
Show answer and explanation
Correct answers: B, C
Explanation
To adhere to the principle of least privilege, it's important to grant only the permissions necessary for the task. The 'Compute Admin' role provides sufficient permissions for managing Compute Engine instances without granting unnecessary access. Alternatively, creating a custom role tailored to specific permissions can also achieve this goal. Avoid using overly broad roles like 'Owner' which provide excessive access beyond what's required.
- A. Incorrect.
Assigning the 'Owner' role is too permissive as it grants full control over all resources in the project, which violates the principle of least privilege.
- B. Correct.
Creating a custom role with specific permissions for managing Compute Engine instances is a good practice for adhering to the principle of least privilege.
- C. Correct.
Granting the 'Compute Admin' role is appropriate for managing Compute Engine instances and aligns with the principle of least privilege if no other permissions are needed.
- D. Incorrect.
The 'Viewer' role only provides read-only access and does not allow management of Compute Engine instances, which is insufficient for the task.