Google Associate Cloud Engineer Question 361
Select 2Google Cloud PlatformYou are managing a Google Cloud project where a service account needs to be granted specific permissions to read objects from a Cloud Storage bucket. Which of the following actions should you take to properly manage IAM roles for this service account?
- A
Assign the 'Storage Object Viewer' role to the service account at the bucket level.
- B
Assign the 'Storage Admin' role to the service account at the project level.
- C
Use a custom IAM role with 'storage.objects.get' permission and assign it to the service account at the bucket level.
- D
Enable the 'Object Versioning' feature on the bucket for the service account to access older versions of objects.
- E
Delegate the IAM management to a different service account with 'iam.serviceAccountUser' role.
Show answer and explanation
Correct answers: A, C
Explanation
To grant a service account the necessary permissions to read objects from a Cloud Storage bucket, it's best to assign roles that provide the least privilege necessary. The 'Storage Object Viewer' role at the bucket level is optimal for read access, and a custom role with specific permissions like 'storage.objects.get' offers fine-grained access control, ensuring the principle of least privilege is maintained.
- A. Correct.
Assigning the 'Storage Object Viewer' role at the bucket level is a precise way to grant read access to objects within that specific bucket.
- B. Incorrect.
The 'Storage Admin' role grants excessive permissions, including write and delete capabilities, which are unnecessary for simply reading objects.
- C. Correct.
Creating a custom role with 'storage.objects.get' permission allows for granular access control, ensuring the service account can only read objects.
- D. Incorrect.
Enabling 'Object Versioning' affects how objects are stored and accessed but does not control permissions.
- E. Incorrect.
Delegating IAM management does not directly grant the required storage permissions to the service account.