GCP PCA · Question 25 · Domain 3: Designing for Security and Compliance
You are auditing IAM permissions for a GCP project. You notice that several developers have been granted the roles/editor basic role. The security team requires that developers should only have the ability to view resources and manage Compute Engine instances, but they should not be able to modify IAM policies or access Cloud Storage buckets. What should you do?
Answer options:
Keep the roles/editor role, but add a deny policy for Cloud Storage and IAM.
Remove the roles/editor role. Grant the developers the roles/viewer and roles/compute.instanceAdmin.v1 predefined roles.
Create a Custom Role with all permissions from the Editor role, minus the storage and IAM permissions.
Remove the roles/editor role. Grant the roles/owner role to a service account and let developers impersonate it.
50 questions · hints · full answers · grading
Expert