Google Associate Cloud Engineer Question 364
Single answerGoogle Cloud PlatformYou have a Google Cloud project where a service account is used by several Compute Engine instances to access Google Cloud Storage. Recently, a new team member needs to manage the IAM roles assigned to this service account. What is the most appropriate way to grant them the ability to manage IAM roles of the service account without giving them broader permissions?
- A
Grant the team member the 'Service Account Admin' role on the project.
- B
Grant the team member the 'IAM Role Admin' role on the project.
- C
Grant the team member the 'Service Account User' role on the service account.
- D
Grant the team member the 'Service Account IAM Admin' role on the service account.
Show answer and explanation
Correct answer: D
Explanation
To manage IAM roles specifically for a service account, the 'Service Account IAM Admin' role is appropriate as it provides the necessary permissions to alter IAM policies for the service account without granting broader permissions over the project or IAM roles themselves.
- A. Incorrect.
The 'Service Account Admin' role allows for the creation and management of service accounts but not the specific management of IAM roles for existing service accounts.
- B. Incorrect.
The 'IAM Role Admin' role allows for the creation and management of IAM roles themselves, not the assignment of roles to service accounts.
- C. Incorrect.
The 'Service Account User' role allows principals to act as the service account and access resources as the service account, but does not allow them to manage the roles assigned to the service account.
- D. Correct.
The 'Service Account IAM Admin' role allows for the management of IAM policies on service accounts, which includes granting roles to the service account.