Google Professional Cloud Developer Question 126
Single answerGoogle Cloud PlatformYou are a cloud developer working on a serverless application hosted on Google Cloud. The application uses a Cloud Function to process data and store it in a Cloud Storage bucket. You want to ensure that the Cloud Function has permissions to read and write to the Cloud Storage bucket, while following the principle of least privilege. What IAM role should you assign to the Cloud Function's service account?
- A
roles/storage.objectAdmin
- B
roles/storage.admin
- C
roles/storage.objectViewer
- D
roles/editor
Show answer and explanation
Correct answer: A
Explanation
To follow the principle of least privilege, you should assign the minimal IAM role required for the task. The 'roles/storage.objectAdmin' role grants the necessary permissions for the Cloud Function to read and write objects in the Cloud Storage bucket without granting unnecessary privileges, such as bucket management or permissions over unrelated services.
- A. Correct.
Correct. The 'roles/storage.objectAdmin' role grants permissions to read, write, and delete objects in a Cloud Storage bucket, which is sufficient for the Cloud Function to perform its tasks. This aligns with the principle of least privilege.
- B. Incorrect.
Incorrect. The 'roles/storage.admin' role grants full control over Cloud Storage resources, including creating and deleting buckets. This exceeds the required permissions and violates the principle of least privilege.
- C. Incorrect.
Incorrect. The 'roles/storage.objectViewer' role only allows viewing objects in a Cloud Storage bucket. It does not provide the necessary permissions to write or delete objects.
- D. Incorrect.
Incorrect. The 'roles/editor' role provides broad permissions across many Google Cloud services and is not specific to Cloud Storage. Assigning this role would violate the principle of least privilege.