Google Professional Cloud Network Engineer Question 37
Select 2Google Cloud PlatformYou are a Cloud Network Engineer tasked with managing a Shared VPC environment in Google Cloud. The host project contains multiple service projects that require distinct access configurations for their teams. To ensure secure and efficient management, which of the following IAM roles should you assign to the users in the service projects to allow them to manage their resources, while ensuring they cannot make changes to the Shared VPC network itself?
- A
Compute Network User role on the host project
- B
Compute Admin role on the host project
- C
Compute Network User role on their respective service project
- D
Compute Security Admin role on their respective service project
- E
Shared VPC Admin role on their respective service project
Show answer and explanation
Correct answers: A, C
Explanation
In a Shared VPC environment, it is crucial to balance access control and functionality. Service project users need the Compute Network User role on the host project to attach their resources to the Shared VPC network. They also need the Compute Network User role on their service project to manage resources within their project. Assigning broader roles, such as Compute Admin or Shared VPC Admin, would violate the principle of least privilege and could lead to security risks.
- A. Correct.
The Compute Network User role on the host project allows users in the service projects to attach their workloads to the Shared VPC network without allowing them to modify the network itself. This is the correct role for this purpose.
- B. Incorrect.
The Compute Admin role on the host project grants broader permissions, including the ability to make changes to the Shared VPC network. This exceeds the requirement and introduces unnecessary risk.
- C. Correct.
The Compute Network User role on their respective service project is required for managing resources within their service project and attaching them to the Shared VPC. This is an appropriate role for service project users.
- D. Incorrect.
The Compute Security Admin role allows users to manage firewall rules and SSL certificates within the project. However, it is not relevant for attaching resources to the Shared VPC.
- E. Incorrect.
The Shared VPC Admin role is intended for managing the Shared VPC configuration at the host project level. Assigning this role to service project users would give them excessive permissions, allowing them to modify the Shared VPC network itself.