Google Professional Cloud Developer Question 123
Select 3Google Cloud PlatformYour development team is working on a Google Cloud project that uses a Cloud Storage bucket to store sensitive user data. The team needs to ensure strict access control while enabling the application to read and write to the bucket. You have been asked to assign the appropriate IAM roles to enforce the principle of least privilege. Which IAM roles should you assign?
- A
Grant the 'roles/storage.objectAdmin' role to the service account used by the application
- B
Grant the 'roles/storage.admin' role to the service account used by the application
- C
Grant the 'roles/storage.objectViewer' role to the developers who need to view objects in the bucket
- D
Grant the 'roles/storage.admin' role to all developers on the team
- E
Grant the 'roles/storage.objectCreator' role to the service account used by the application
Show answer and explanation
Correct answers: A, C, E
Explanation
When assigning IAM roles, it is critical to follow the principle of least privilege to minimize the risk of unintended access. The 'roles/storage.objectAdmin' role provides sufficient permissions for the application to read and write objects, while the 'roles/storage.objectCreator' role allows object uploads without granting excessive permissions. For developers, the 'roles/storage.objectViewer' role is appropriate if they only need to view bucket contents. Avoid assigning overly broad roles such as 'roles/storage.admin' unless absolutely required.
- A. Correct.
The 'roles/storage.objectAdmin' role allows the service account to read, write, and delete objects in the bucket, which satisfies the application's need without granting excessive permissions.
- B. Incorrect.
The 'roles/storage.admin' role is overly permissive because it provides full control over the bucket, including managing IAM policies, which violates the principle of least privilege.
- C. Correct.
The 'roles/storage.objectViewer' role is appropriate for developers who only need to view bucket contents without modifying them.
- D. Incorrect.
Granting the 'roles/storage.admin' role to all developers is overly permissive and not aligned with the principle of least privilege.
- E. Correct.
The 'roles/storage.objectCreator' role allows the service account to upload objects to the bucket, which is necessary if the application needs to write data, but it does not grant unnecessary permissions.