Google Professional Cloud DevOps Engineer Question 91
Select 2Google Cloud PlatformYour organization uses Google Cloud for multiple environments: 'development', 'staging', and 'production'. Each environment has its own Google Cloud projects. The security team has requested that IAM policies be set up to ensure that developers can only view resources in the 'production' environment and have full access to resources in the 'development' and 'staging' environments. How should you configure the IAM policies to meet these requirements?
- A
Grant the 'Viewer' role on the production project to the developers.
- B
Grant the 'Owner' role on the development and staging projects to the developers.
- C
Grant the 'Editor' role on the production project to the developers.
- D
Create a custom role that combines 'Viewer' access to production and 'Editor' access to development and staging, and assign it to the developers.
- E
Grant the 'Editor' role on the development and staging projects to the developers.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the security team's requirements, developers need 'Viewer' access to the production environment to ensure they cannot modify any resources. In the development and staging environments, developers require full access to resources, which is provided by the 'Editor' role. Assigning roles that align with the principle of least privilege is critical for maintaining security while ensuring operational efficiency.
- A. Correct.
Correct: The 'Viewer' role on the production project allows developers to view resources as required by the security team.
- B. Incorrect.
Partially correct: While the 'Owner' role provides full access, it also gives developers excessive permissions, such as the ability to manage IAM policies, which is not aligned with least privilege principles.
- C. Incorrect.
Incorrect: Providing the 'Editor' role on the production project would give developers the ability to modify resources, which violates the security team's requirements.
- D. Incorrect.
Incorrect: Combining 'Viewer' and 'Editor' access into a custom role is unnecessary and complicates management when standard roles can meet the requirements.
- E. Correct.
Correct: The 'Editor' role on the development and staging projects allows developers to have full access to resources in these environments, as required.