Google Professional Cloud Network Engineer Question 36
Select 2Google Cloud PlatformYou are tasked with designing IAM roles for a Shared VPC environment in Google Cloud. The Shared VPC host project 'host-network-project' contains all network resources, while the service project 'service-app-project' houses application workloads. Developers in 'service-app-project' need to deploy Compute Engine instances using subnets from the host project without being granted excessive permissions. Which IAM roles should be assigned to achieve this?
- A
Compute Network User role on the Shared VPC host project to the developers
- B
Compute Admin role on the Shared VPC host project to the developers
- C
Compute Network User role on specific subnets in the Shared VPC host project to the developers
- D
Compute Viewer role on the service project to the developers
- E
Compute Admin role on the service project to the developers
Show answer and explanation
Correct answers: C, E
Explanation
In a Shared VPC environment, the 'Compute Network User' role on specific subnets in the host project allows developers to use only the necessary subnets for their workloads while adhering to the principle of least privilege. The 'Compute Admin' role on the service project gives developers adequate permissions to create and manage Compute Engine instances within their own project without interfering with network resources in the host project. This setup ensures proper separation of duties and secure access management.
- A. Incorrect.
Granting the 'Compute Network User' role on the entire Shared VPC host project would allow developers to use all subnets in the project, which might exceed the principle of least privilege. This is not recommended.
- B. Incorrect.
Granting the 'Compute Admin' role on the Shared VPC host project gives developers excessive permissions, including management of all network resources, and violates the principle of least privilege.
- C. Correct.
Assigning the 'Compute Network User' role on specific subnets ensures that developers can use only the required subnets in the Shared VPC host project, adhering to the principle of least privilege.
- D. Incorrect.
The 'Compute Viewer' role only provides read access to Compute Engine resources and is insufficient for deploying instances.
- E. Correct.
Assigning the 'Compute Admin' role on the service project allows developers to manage Compute Engine resources in their own project, such as creating instances, while maintaining separation of duties.