Google Professional Cloud DevOps Engineer Question 225
Select 2Google Cloud PlatformYour organization has three environments: development, staging, and production. You are tasked with ensuring that developers can only manage resources in the development environment, while site reliability engineers (SREs) have full control over the staging and production environments. Which of the following IAM policy configurations would best meet these requirements?
- A
Grant developers the 'roles/editor' role on the development environment project and deny all other permissions explicitly in staging and production.
- B
Grant developers the 'roles/editor' role at the organization level and SREs the 'roles/owner' role at the staging and production project levels.
- C
Grant developers the 'roles/editor' role on the development environment project only, and grant SREs the 'roles/owner' role on the staging and production environment projects.
- D
Grant developers the 'roles/viewer' role on all projects, and grant SREs the 'roles/editor' role on staging and production projects.
- E
Grant developers the 'roles/editor' role on the development environment folder, and grant SREs the 'roles/owner' role on staging and production environment folders.
Show answer and explanation
Correct answers: C, E
Explanation
To meet the requirements, developers should only have permissions to manage resources in the development environment, and SREs should have full control over staging and production. Options 3 and 5 achieve this by following the principle of least privilege and leveraging Google Cloud's hierarchical IAM structure to apply permissions at the appropriate level (project or folder).
- A. Incorrect.
This option explicitly denies permissions in staging and production, which is not a best practice as explicit denies can lead to maintenance complexity and unintentional access issues.
- B. Incorrect.
Granting developers the 'roles/editor' role at the organization level violates the principle of least privilege, as it would give them permissions beyond the development environment.
- C. Correct.
This option correctly assigns the 'roles/editor' role to developers only in the development environment and grants sufficient permissions (roles/owner) to SREs in staging and production environments.
- D. Incorrect.
Granting developers only the 'roles/viewer' role on all projects would not meet the requirement for them to manage resources in the development environment.
- E. Correct.
This option ensures proper segregation by assigning the 'roles/editor' role to developers on the development folder and giving SREs control over staging and production folders. This aligns with best practices for hierarchical IAM policies.