Google Professional Cloud Security Engineer Question 152
Single answerGoogle Cloud PlatformYour organization uses Google Cloud IAM to securely manage permissions across projects. You have been tasked with granting a team of developers access to a specific Cloud Storage bucket while ensuring permissions are easy to manage in the future. How should you configure permissions to meet this requirement?
- A
Assign the required IAM role directly to each developer individually at the bucket level.
- B
Create a Google Group for the developers, add all developers to the group, and assign the required IAM role to the group at the bucket level.
- C
Assign the required IAM role to each developer at the project level to ensure broad access.
- D
Enable Public Access on the Cloud Storage bucket and share the bucket link with the developers.
Show answer and explanation
Correct answer: B
Explanation
The best solution is to manage permissions through Google Groups. By creating a group for the developers and assigning the required IAM role to the group, you ensure a secure, scalable, and auditable approach to permission management. This method also adheres to the principle of least privilege while simplifying future updates when team members join or leave.
- A. Incorrect.
Assigning roles directly to each developer individually is not scalable or efficient, especially in environments where team members frequently change. Managing permissions for individual users can lead to errors and is difficult to audit.
- B. Correct.
Using a Google Group to manage developers and assigning the required IAM role to the group ensures a scalable and efficient permission management strategy. When team members join or leave, only the group membership needs to be updated, not the IAM policies.
- C. Incorrect.
Assigning broad roles at the project level can lead to over-permissioning, violating the principle of least privilege. Developers would gain unnecessary access to other resources beyond the required Cloud Storage bucket.
- D. Incorrect.
Enabling Public Access on the Cloud Storage bucket is a severe security risk. It violates best practices and can expose sensitive data to unauthorized users.