Google Professional Cloud DevOps Engineer Question 92
Single answerGoogle Cloud PlatformYour company uses separate Google Cloud projects for development, staging, and production environments. As a DevOps engineer, you are tasked with configuring IAM policies to ensure that developers can only deploy and manage resources in the development project, while restricting their access to staging and production projects. How should you configure the IAM policies to meet this requirement?
- A
Grant the 'Editor' role to the developers at the organization level.
- B
Grant the 'Editor' role to the developers at the development project level and no roles for staging or production projects.
- C
Grant the 'Owner' role to the developers at the development project level, and the 'Viewer' role for staging and production projects.
- D
Grant the 'Viewer' role to the developers at the organization level and the 'Editor' role at the development project level.
Show answer and explanation
Correct answer: B
Explanation
To enforce environment-specific access controls, IAM policies should adhere to the principle of least privilege. Developers only need the 'Editor' role for the development project to perform their tasks, while staging and production projects should remain restricted. Granting roles at inappropriate levels (e.g., organization level) or granting excessive permissions (e.g., 'Owner' role) violates security best practices.
- A. Incorrect.
Granting the 'Editor' role at the organization level would give developers excessive access to all projects, including staging and production, violating the principle of least privilege.
- B. Correct.
Granting the 'Editor' role to the developers at the development project level ensures they can manage resources in the development environment, while no roles for staging or production projects prevents access to those environments, aligning with the given requirement.
- C. Incorrect.
Granting the 'Owner' role at the development project level provides unnecessary permissions, such as IAM policy management, which isn't required for developers. Additionally, granting the 'Viewer' role for staging and production projects still allows developers to view sensitive information in those environments, which may be against policy.
- D. Incorrect.
Granting the 'Viewer' role at the organization level would allow developers to view resources across all projects, including staging and production, which is not permitted based on the requirement.