Access control (IAM vs ACLs) in GCP - Interactive Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to grant a user the role of Storage Object Viewer using IAM.

GCP

resource = "projects/my-project"
policy = client.get_iam_policy(resource)
policy.bindings.append({"role": "[1]", "members": ["user:[e-mail]"]})
client.set_iam_policy(resource, policy)

Drag options to blanks, or click blank then click option'

Aroles/editor

Broles/storage.admin

Croles/compute.viewer

Droles/storage.objectViewer

Attempts:

3 left

💡 Hint

Common Mistakes

Using admin role when only viewer is needed

Confusing compute roles with storage roles

The correct IAM role to view storage objects is roles/storage.objectViewer. This grants read-only access to objects.

2fill in blank

medium

Complete the code to set an ACL that grants read access to all users on a Cloud Storage bucket.

GCP

bucket = client.get_bucket('my-bucket')
bucket.acl.[1].all().grant_read()
bucket.acl.save()

Drag options to blanks, or click blank then click option'

Auser

Bgroup

Cpublic

Ddefault

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'public' for open access

Forgetting to save the ACL after changes

To grant read access to all users, use the public ACL entity.

3fill in blank

hard

Fix the error in the IAM policy binding to correctly specify the member type for a service account.

GCP

policy.bindings.append({"role": "roles/storage.admin", "members": ["[1]:[e-mail]"]})

Drag options to blanks, or click blank then click option'

AserviceAccount

Buser

Cgroup

Ddomain

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' prefix for service accounts

Omitting the prefix entirely

Service accounts must be prefixed with serviceAccount: in IAM member strings.

4fill in blank

hard

Fill both blanks to create an IAM policy that grants a group the role of Compute Viewer on a project.

GCP

policy.bindings.append({"role": "[1]", "members": ["[2]:[e-mail]"]})

Drag options to blanks, or click blank then click option'

Aroles/compute.viewer

Broles/storage.admin

Cgroup

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'group' for group members

Choosing wrong roles like storage admin for compute tasks

The role for viewing compute resources is roles/compute.viewer, and the member type for groups is group.

5fill in blank

hard

Fill all three blanks to create an ACL entry that grants write access to a specific user on a bucket.

GCP

bucket.acl.[1].[2]().grant_[3]()
bucket.acl.save()

Drag options to blanks, or click blank then click option'

Auser

Ball

Cwrite

Dgroup

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'group' instead of 'user' for individual access

Using grant_read() instead of grant_write() for write access

To grant write access to a specific user, use user entity, select all() to target all entries for that user, and call grant_write().