GCP ACE · Question 42 · Domain 5.1: Managing Identity and Access Management (IAM)
Your security team requires a specific IAM role that allows users to start and stop Compute Engine instances, but absolutely nothing else (no creating, no deleting, no viewing disks). You have checked the predefined roles and none match this exact requirement.
What should you do?
Answer options:
Assign the 'Compute Instance Admin' predefined role.
Create a Custom IAM role containing only the 'compute.instances.start' and 'compute.instances.stop' permissions.
Assign the 'Editor' primitive role and use IAM conditions to restrict it.
Submit a feature request to Google Support to create a new predefined role.
50 questions · hints · full answers · grading
Expert