Google Professional Cloud Security Engineer Question 25
Select 2Google Cloud PlatformYou are tasked with programmatically managing user accounts and groups in a Google Cloud environment. Your goal is to automate the addition of new users to a specific Google Cloud Identity Group and assign them predefined roles at the project level. Which of the following steps should you take to achieve this?
- A
Use the Google Cloud Admin SDK Directory API to add users to the group.
- B
Configure a Cloud Function to call the IAM API for assigning roles to the users.
- C
Use the gcloud CLI to directly add users to the group and assign roles within a script.
- D
Leverage the Identity and Access Management (IAM) API to add users to the group.
- E
Set up a Pub/Sub trigger to automate group membership changes through the Admin SDK Directory API.
Show answer and explanation
Correct answers: A, B
Explanation
To programmatically manage user accounts and groups, the Google Cloud Admin SDK Directory API is used for handling group membership, while the IAM API is used for managing access control policies, including assigning roles to users. Combining these APIs with automation tools like Cloud Functions ensures a robust and scalable solution.
- A. Correct.
Correct: The Google Cloud Admin SDK Directory API is specifically designed for managing users and groups programmatically, making it the correct option for adding users to groups.
- B. Correct.
Correct: The IAM API can be programmatically invoked through a Cloud Function to assign roles to users at the project level, fitting the requirement for automation.
- C. Incorrect.
Incorrect: While the gcloud CLI can manage users and groups, it is not a programmatic solution suitable for automation in this scenario.
- D. Incorrect.
Incorrect: The IAM API does not handle group membership directly. It is used for managing access control policies, such as assigning roles to users.
- E. Incorrect.
Incorrect: Pub/Sub triggers can automate processes, but they are not directly involved in managing user accounts or groups. The Admin SDK Directory API is required for group membership changes.