Google Professional Cloud Security Engineer Question 135
Select 2Google Cloud PlatformYour organization has multiple teams working on different projects under a single Google Cloud Organization. The security team has identified a need to limit access to sensitive Cloud Storage buckets to only specific users. A junior engineer suggests assigning the 'Storage Admin' role at the organization level to simplify management. However, you want to implement the principle of least privilege while still allowing specific users access to manage these buckets. What steps should you take to achieve this?
- A
Assign the 'Storage Admin' role at the folder level to the team managing the buckets.
- B
Create a custom role with only the required permissions for bucket management and assign it at the project level.
- C
Grant the 'Storage Object Admin' role directly on the specific Cloud Storage buckets to the required users.
- D
Assign the 'Storage Admin' role at the organization level to all team members.
- E
Use Resource Manager policies to block inheritance of broad roles at the folder level.
Show answer and explanation
Correct answers: B, C
Explanation
To follow the principle of least privilege, you should grant only the necessary permissions and scope them as narrowly as possible. Creating a custom role at the project level and granting direct permissions on the specific resources (buckets) are both valid approaches to ensure that access is restricted to only what is needed. Avoid assigning overly broad roles at higher hierarchy levels, as this can inadvertently grant unnecessary access.
- A. Incorrect.
Assigning the 'Storage Admin' role at the folder level provides broad access to manage all storage resources in the folder, which violates the principle of least privilege.
- B. Correct.
Creating a custom role with only the required permissions and assigning it at the project level ensures that only the necessary permissions are granted, aligning with the principle of least privilege.
- C. Correct.
Granting the 'Storage Object Admin' role directly on the specific buckets ensures that access is limited to only the required resources, following the principle of least privilege.
- D. Incorrect.
Assigning the 'Storage Admin' role at the organization level would grant excessive permissions across all buckets and projects, violating the principle of least privilege.
- E. Incorrect.
Using Resource Manager policies to block inheritance of broad roles is not a valid approach as it does not directly address limiting access to the buckets.