A new developer joins your team and needs to view the logs for a specific Cloud Run service to troubleshoot an issue. They should not be able to modify the service or view logs for other services. Which IAM role should you grant?

Google Cloud IAM follows the principle of least privilege. Basic roles (Owner/Editor/Viewer) should be avoided in production. Predefined roles (like `roles/logging.viewer`) provide granular permissions. Furthermore, IAM policies should be applied at the lowest possible level in the resource hierarchy (in this case, the specific Cloud Run service, not the entire Project) to restrict access strictly to what is needed.