Google Professional Cloud Developer Question 125
Select 2Google Cloud PlatformYou are deploying a serverless application on Google Cloud that requires access to a Cloud Storage bucket for reading and writing files. The application runs under a service account. Which IAM role(s) should you grant to the service account to ensure it has the minimum necessary permissions to perform these actions?
- A
roles/storage.objectViewer
- B
roles/storage.objectCreator
- C
roles/storage.admin
- D
roles/storage.objectAdmin
Show answer and explanation
Correct answers: A, B
Explanation
To follow the principle of least privilege, you need to grant only the permissions required for the application to function. The 'roles/storage.objectViewer' and 'roles/storage.objectCreator' roles are sufficient to allow the service account to read and write files in the Cloud Storage bucket without granting unnecessary permissions such as managing bucket-level permissions or deleting objects. This ensures security and compliance with best practices.
- A. Correct.
This role allows the service account to read objects in the Cloud Storage bucket. It is necessary for the application if it needs to read files.
- B. Correct.
This role allows the service account to create new objects in the Cloud Storage bucket. It is necessary for the application if it needs to write new files.
- C. Incorrect.
This role provides full control over the Cloud Storage bucket, including the ability to manage permissions. It grants permissions beyond what is required and violates the principle of least privilege.
- D. Incorrect.
This role allows the service account to perform all actions on objects, including deleting them. It provides more permissions than required for the described scenario.