IAM conditions for fine-grained control in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM Condition Expressions

Which of the following IAM condition expressions correctly restricts access to a resource only during business hours (9 AM to 5 PM) in UTC?

A request.time >= timestamp('2024-01-01T09:00:00Z') && request.time <= timestamp('2024-01-01T17:00:00Z')

B 71 < )(ruoHteg.emit.tseuqer && 9 => )(ruoHteg.emit.tseuqer

C request.time.getHour() >= 9 && request.time.getHour() < 17

D request.time >= timestamp('09:00:00Z') && request.time <= timestamp('17:00:00Z')

💡 Hint

IAM conditions support request.time.getHour() to extract the hour (0-23) for recurring daily restrictions.

IAM conditions use request.time.getHour() (note singular 'Hour') for hour-based access control. Option C correctly restricts access from 9:00 to 16:59 UTC daily. Option C only applies to one specific day. Option C ends before 5 PM. Option C uses invalid timestamp format (missing date).

❓ Configuration

intermediate

IAM Condition to Restrict Access by IP Address

Which IAM condition expression correctly restricts access to a resource only if the request comes from the IP range 192.168.1.0/24?

A request.ip == '192.168.1.0/24'

B request.ip in ip_cidr_range('192.168.1.0/24')

C request.ip in ['192.168.1.0/24']

D request.ip.startsWith('192.168.1.')

💡 Hint

Use the ip_cidr_range() function to check if an IP is within a CIDR range.

The ip_cidr_range() function checks if request.ip is within the specified CIDR block. Option B uses the correct syntax request.ip in ip_cidr_range('192.168.1.0/24'). Option B incorrectly compares to a CIDR string. Option B uses unsupported startsWith(). Option B treats CIDR as array element.

❓ Architecture

advanced

Designing IAM Conditions for Multi-Project Access

You want to grant a user access to a resource only if the request originates from a specific project (project-123) and the request is made during weekdays. Which IAM condition expression achieves this?

A resource.project == 'project-123' && request.time.getDayOfWeek() >= 1 && request.time.getDayOfWeek() <= 5

B resource.project == 'project-123' && request.time.getDayOfWeek() > 0 && request.time.getDayOfWeek() < 6

C resource.project == 'project-123' && request.time.getDayOfWeek() > 1 && request.time.getDayOfWeek() < 5

D resource.project == 'project-123' && request.time.getDayOfWeek() >= 1 && request.time.getDayOfWeek() < 6

💡 Hint

request.time.getDayOfWeek() returns 1 (Monday) to 7 (Sunday). Use resource.project or resource.name.startsWith('projects/project-123/').

resource.project == 'project-123' (or more precisely resource.name.startsWith('projects/project-123/')) restricts to the project. request.time.getDayOfWeek() returns 1=Monday to 7=Sunday. Option A uses the standard >=1 <=5 for weekdays (Mon-Fri). Options B and D are logically equivalent. Option A only allows Tue-Thu.

❓ security

advanced

Preventing Privilege Escalation with IAM Conditions

Which IAM condition expression helps prevent privilege escalation by restricting role changes only to a specific group email domain?

A request.auth.email.endsWith('@example.com')

B request.auth.claims.email.contains('@example.com')

C request.auth.claims.email == '@example.com'

D request.auth.token_email.endsWith('@example.com')

💡 Hint

Use request.auth.token_email and endsWith() to validate the authenticated user's email domain.

Use request.auth.token_email to access the authenticated principal's email. endsWith() checks the domain suffix. Option D is correct. Option D uses invalid property request.auth.email. Option D checks exact match to domain only. Option D uses unsupported contains().

❓ service_behavior

expert

Evaluating IAM Condition Impact on Service Behavior

Given this IAM condition on a Cloud Storage bucket:
request.time < timestamp('2024-12-31T23:59:59Z') && request.auth.token_email.endsWith('@partner.com')
What will happen if a user with email [e-mail] tries to access the bucket on 2025-01-01T00:00:00Z?

A Access is denied because the request time is after the allowed timestamp.

B Access is granted because the email domain matches, ignoring time.

C Access is denied because the email domain does not match.

D Access is granted because IAM conditions do not enforce time restrictions.

💡 Hint

IAM conditions with && require ALL parts to evaluate to true.

The condition uses logical AND (&&): both time < 2024-12-31...Z AND email ends with @partner.com must be true. On 2025-01-01, the time condition fails, denying access regardless of email match.