Google Professional Cloud Security Engineer Question 113
Select 2Google Cloud PlatformYour organization uses Google Cloud and has recently onboarded a team of contractors who need limited access to specific resources for a short-term project. The contractors should only be allowed to view logs in Cloud Logging and access specific Compute Engine instances. What is the best way to implement authorization controls to meet these requirements?
- A
Create a custom IAM role that grants only the required permissions and assign it to the contractors.
- B
Assign the 'Viewer' role at the organization level to the contractors.
- C
Use predefined roles such as 'Logging Viewer' and 'Compute Engine Instance Viewer' to grant the necessary permissions.
- D
Grant the 'Owner' role at the project level to the contractors to ensure they can view all required resources.
- E
Use Resource Manager to apply restrictive IAM policies only on the necessary resources.
Show answer and explanation
Correct answers: A, C
Explanation
The principle of least privilege is crucial when managing authorization controls. By creating a custom IAM role or using predefined roles like 'Logging Viewer' and 'Compute Engine Instance Viewer,' you ensure that the contractors receive only the permissions required for their tasks, reducing the risk of overprovisioning or accidental misuse. Assigning broad roles like 'Viewer' or 'Owner' or applying policies at inappropriate levels can lead to security risks and unintended access.
- A. Correct.
Creating a custom IAM role allows you to specify only the exact permissions needed for the contractors, ensuring least privilege access. This is an effective and secure approach.
- B. Incorrect.
Assigning the 'Viewer' role at the organization level gives the contractors read access to all resources across the organization, violating the principle of least privilege.
- C. Correct.
Using predefined roles like 'Logging Viewer' and 'Compute Engine Instance Viewer' is a straightforward and secure way to grant only the necessary permissions without overprovisioning access.
- D. Incorrect.
Granting the 'Owner' role at the project level gives excessive privileges, including administrative rights, which violates the principle of least privilege.
- E. Incorrect.
While Resource Manager can help to manage IAM policies, it does not directly define roles or permissions. It serves as a tool for structuring resource hierarchies and policy inheritance, not a solution to granular authorization needs.