IAM policy binding in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the role in the IAM policy binding.

GCP

{
  "role": "[1]",
  "members": ["user:[e-mail]"]
}

Drag options to blanks, or click blank then click option'

Aroles/storage.admin

Broles/editor

Croles/owner

Droles/viewer

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing roles/editor or roles/owner when only read access is needed.

Using a storage-specific role when the task is general.

The role roles/viewer grants read-only access, which is a common starting point for IAM bindings.

2fill in blank

medium

Complete the code to specify a member type in the IAM policy binding.

GCP

{
  "role": "roles/viewer",
  "members": ["[1]:[e-mail]"]
}

Drag options to blanks, or click blank then click option'

Auser

BserviceAccount

Cgroup

Ddomain

Attempts:

3 left

💡 Hint

Common Mistakes

Using group or domain when specifying a single user.

Using serviceAccount when the member is a user.

The member type user is used to specify an individual user email in IAM bindings.

3fill in blank

hard

Fix the error in the IAM policy binding by completing the member string correctly.

GCP

{
  "role": "roles/storage.objectViewer",
  "members": ["[1]:[e-mail]"]
}

Drag options to blanks, or click blank then click option'

Auser

BserviceAccount

Cgroup

Ddomain

Attempts:

3 left

💡 Hint

Common Mistakes

Using user or group prefix for service account emails.

Omitting the prefix entirely.

Service accounts must be prefixed with serviceAccount in IAM member strings.

4fill in blank

hard

Fill both blanks to create an IAM policy binding with a group member and the correct role.

GCP

{
  "role": "[1]",
  "members": ["[2]:[e-mail]"]
}

Drag options to blanks, or click blank then click option'

Aroles/editor

Buser

Cgroup

Droles/viewer

Attempts:

3 left

💡 Hint

Common Mistakes

Using user instead of group for a group email.

Choosing roles/viewer instead of roles/editor for editing access.

The roles/editor role allows editing permissions, and the member is a group identified by an email.

5fill in blank

hard

Fill both blanks to create an IAM policy binding with a domain member and a storage admin role.

GCP

{
  "role": "[1]",
  "members": ["[2]:example.com"]
}

Drag options to blanks, or click blank then click option'

Aroles/viewer

Buser

Cdomain

Droles/storage.admin

Attempts:

3 left

💡 Hint

Common Mistakes

Using user or group instead of domain for domain-wide access.

Choosing roles/viewer instead of roles/storage.admin for admin access.

The roles/storage.admin role grants full storage admin rights, and the member type domain applies to all users in the domain.