Google Associate Cloud Engineer Question 340
Select 3Google Cloud PlatformYou are a Google Cloud Engineer tasked with setting up Identity and Access Management (IAM) for a new project. The project requires a custom IAM role that grants users the ability to view logs in Cloud Logging but not modify or delete them. Which steps should you take to create this custom IAM role?
- A
Navigate to the IAM & Admin section in the Google Cloud Console and select 'Roles'.
- B
Select an existing predefined role that has similar permissions and click 'Edit Role'.
- C
Click 'Create Role' and provide a name, title, and description for the custom role.
- D
Add the permission 'logging.logs.list' to the custom role.
- E
Add the permission 'logging.logs.delete' to the custom role.
Show answer and explanation
Correct answers: A, C, D
Explanation
To create a custom IAM role in Google Cloud Platform, you must navigate to the IAM & Admin section, where you can create a new role by providing necessary details like name, title, and description. Then, you add the specific permissions required for your use case, in this scenario 'logging.logs.list' for viewing logs. It is important not to include permissions that grant abilities not intended for the role, such as 'logging.logs.delete' for deleting logs.
- A. Correct.
Correct. To create a custom role, you need to navigate to the IAM & Admin section and select 'Roles'.
- B. Incorrect.
Incorrect. You cannot edit predefined roles directly; you need to create a new custom role.
- C. Correct.
Correct. Creating a custom role requires you to provide a name, title, and description.
- D. Correct.
Correct. The permission 'logging.logs.list' allows viewing logs, which is required for this scenario.
- E. Incorrect.
Incorrect. The permission 'logging.logs.delete' allows deletion of logs, which is not desired in this scenario.