Google Associate Cloud Engineer Question 343
Select 2Google Cloud PlatformYou are a Google Cloud Associate Cloud Engineer tasked with setting up access controls for a new project. The project requires a specific team to have permission to view and edit BigQuery datasets, but not to delete them. Which of the following approaches would best meet this requirement?
- A
Assign the predefined 'BigQuery Data Editor' role to the team.
- B
Assign the predefined 'BigQuery Data Viewer' role to the team.
- C
Create a custom IAM role with 'bigquery.datasets.get' and 'bigquery.datasets.update' permissions.
- D
Create a custom IAM role with 'bigquery.datasets.create' and 'bigquery.datasets.update' permissions.
- E
Assign the predefined 'BigQuery Admin' role to the team.
Show answer and explanation
Correct answers: A, C
Explanation
To meet the requirement of allowing a team to view and edit BigQuery datasets without the ability to delete them, you can either assign the predefined 'BigQuery Data Editor' role which has the necessary permissions except for delete, or create a custom role with specific permissions such as 'bigquery.datasets.get' and 'bigquery.datasets.update'. Both approaches ensure the team can view and edit datasets while restricting delete capabilities.
- A. Correct.
The 'BigQuery Data Editor' role allows users to read and modify data within BigQuery datasets but does not allow them to delete datasets, which aligns with the requirements.
- B. Incorrect.
The 'BigQuery Data Viewer' role only provides permission to read data and does not allow editing, so it doesn't meet the requirement.
- C. Correct.
Creating a custom role with 'bigquery.datasets.get' and 'bigquery.datasets.update' permissions will allow viewing and editing without delete permissions, which meets the requirement.
- D. Incorrect.
While this custom role allows creating and updating datasets, it does not include the 'get' permission necessary for viewing datasets.
- E. Incorrect.
The 'BigQuery Admin' role is too permissive as it includes delete permissions, which is not desired in this scenario.