Google Professional Cloud Security Engineer Question 109
Select 2Google Cloud PlatformYour organization is using Google Cloud IAM to manage role-based access control for a critical application. To ensure the principle of least privilege is enforced, you need to set up permissions for a team of developers who require access to specific resources for debugging purposes. The developers should be able to view logs and metrics within Cloud Monitoring and Cloud Logging but should not have the ability to modify or delete any resources. Which IAM role or combination of roles would you assign to the developers to meet these requirements?
- A
Logs Viewer
- B
Monitoring Viewer
- C
Monitoring Admin
- D
Owner
- E
Editor
Show answer and explanation
Correct answers: A, B
Explanation
To enforce the principle of least privilege, you should only assign the minimum permissions necessary for the developers to perform their debugging tasks. The Logs Viewer and Monitoring Viewer roles provide the required access to view logs and metrics without granting unnecessary permissions to modify or delete resources. Assigning roles such as Monitoring Admin, Owner, or Editor would provide excessive permissions and could lead to potential security risks.
- A. Correct.
The Logs Viewer role grants permissions to view logs in Cloud Logging but does not allow modification or deletion of logs, making it suitable for this use case.
- B. Correct.
The Monitoring Viewer role allows the developers to view metrics in Cloud Monitoring but does not grant permissions to modify or delete resources, aligning with the principle of least privilege.
- C. Incorrect.
The Monitoring Admin role provides broad permissions to manage Cloud Monitoring resources, including modifying configurations, which exceeds the requirements and violates the principle of least privilege.
- D. Incorrect.
The Owner role grants full access to all resources within a project, including the ability to modify or delete them, which violates the principle of least privilege.
- E. Incorrect.
The Editor role grants broad permissions to modify most resources within a project, which is unnecessary and violates the principle of least privilege.