IAM conditions for fine-grained control in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the condition title in an IAM policy binding.

GCP

"condition": {"title": "[1]"}

Drag options to blanks, or click blank then click option'

AAccessTimeRestriction

BResourceLimit

CAllowAccess

DUserCheck

Attempts:

3 left

💡 Hint

Common Mistakes

Using generic or unrelated titles like 'AllowAccess' which do not describe the condition purpose.

The title field names the condition. Here, 'AccessTimeRestriction' clearly describes a time-based access control.

2fill in blank

medium

Complete the code to specify the expression that restricts access to requests from a specific IP range.

GCP

"expression": "request.remoteAddress [1] ip_range(\"192.168.1.0/24\")"

Drag options to blanks, or click blank then click option'

A==

Bin

Ccontains

Dmatches

Attempts:

3 left

💡 Hint

Common Mistakes

Using '==' which compares exact IPs, not ranges.

The in operator checks if the request IP is within the specified IP range.

3fill in blank

hard

Fix the error in the IAM condition expression to correctly restrict access to requests made before 6 PM UTC.

GCP

"expression": "request.time [1] timestamp(\"2024-01-01T18:00:00Z\")"

Drag options to blanks, or click blank then click option'

A>

B<=

C>=

D<

Attempts:

3 left

💡 Hint

Common Mistakes

Using '>' which would allow access after 6 PM instead of before.

To allow access only before 6 PM UTC, the request time must be less than the timestamp.

4fill in blank

hard

Fill both blanks to create a condition that allows access only if the request is from a specific service account and during business hours.

GCP

"expression": "request.auth.principalEmail == \"[1]\" && request.time [2] timestamp(\"2024-01-01T17:00:00Z\")"

Drag options to blanks, or click blank then click option'

[e-mail]

B>

C<

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using a user email instead of a service account email.

Using '>' which allows access after the time.

The condition checks if the request is from the specified service account and the time is before 5 PM UTC.

5fill in blank

hard

Fill all three blanks to write a condition that grants access if the request is from a specific IP range, made by a user with a certain email domain, and during weekdays.

GCP

"expression": "request.remoteAddress [1] ip_range(\"10.0.0.0/16\") && request.auth.principalEmail.endsWith(\"[2]\") && (request.time.date().day_of_week() [3] 1 || request.time.date().day_of_week() [3] 5)"

Drag options to blanks, or click blank then click option'

Ain

[e-mail]

C>=

D<=

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong IP operator.

Using incorrect email domain format.

Using '>=' which would allow access on weekends.

The condition checks if the IP is in the range, the email ends with '@example.com', and the day is Friday or earlier (weekday).