Bird
Raised Fist0
GCPcloud~30 mins

Least privilege principle in GCP - Mini Project: Build & Apply

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime

Start learning this pattern below

Jump into concepts and practice - no test required

or
Recommended
Test this pattern10 questions across easy, medium, and hard to know if this pattern is strong
Implementing Least Privilege Principle in GCP IAM
📖 Scenario: You are managing access to a Google Cloud Platform (GCP) project. To keep your project secure, you want to follow the least privilege principle. This means giving users only the permissions they need to do their job, nothing more.Imagine you have a team member who needs to view storage buckets but should not change or delete anything.
🎯 Goal: Build a simple IAM policy that grants a user the minimum permissions needed to view storage buckets in a GCP project.
📋 What You'll Learn
Create a dictionary called iam_policy representing the IAM policy.
Add a bindings list inside iam_policy.
Add a binding that grants the role roles/storage.objectViewer to the member user:viewer@example.com.
Ensure the policy follows the least privilege principle by granting only the necessary role.
💡 Why This Matters
🌍 Real World
IAM policies control who can do what in your cloud projects. Using least privilege helps keep your cloud resources safe from accidental or malicious changes.
💼 Career
Cloud engineers and security specialists regularly create and manage IAM policies to enforce security best practices in cloud environments.
Progress0 / 4 steps
1
Create the initial IAM policy dictionary
Create a dictionary called iam_policy with an empty list for the key bindings.
GCP
Hint

Use curly braces {} to create a dictionary and set "bindings" to an empty list [].

2
Add a binding for the storage object viewer role
Add a dictionary to the bindings list inside iam_policy. This dictionary should have the key role with the value "roles/storage.objectViewer" and the key members with a list containing "user:viewer@example.com".
GCP
Hint

Append a dictionary with keys role and members to the bindings list.

3
Verify the IAM policy structure
Use a for loop with variables binding to iterate over iam_policy["bindings"] and check that each binding has the keys role and members.
GCP
Hint

Use for binding in iam_policy["bindings"]: and check keys with "role" in binding.

4
Complete the IAM policy with version and etag
Add the keys version with value 1 and etag with value "BwWWja0YfJA=" to the iam_policy dictionary to complete the policy structure.
GCP
Hint

Add "version": 1 and "etag": "BwWWja0YfJA=" keys to the iam_policy dictionary.

Practice

(1/5)
1. What does the least privilege principle mean in cloud security?
easy
A. Grant access based on seniority, not tasks
B. Give all users full access to all resources
C. Allow users to share passwords for easier access
D. Give users only the access they need to do their job

Solution

  1. Step 1: Understand the principle meaning

    Least privilege means limiting access rights to the minimum necessary for tasks.

  2. Step 2: Match the correct description

    Give users only the access they need to do their job correctly states giving only needed access, while others give too much or irrelevant access.

  3. Final Answer:

    Give users only the access they need to do their job -> Option D

  4. Quick Check:

    Least privilege = minimal necessary access [OK]
Hint: Least privilege means minimal access needed only [OK]
Common Mistakes:
  • Thinking least privilege means full access
  • Confusing least privilege with password sharing
  • Assuming access depends on seniority
2. Which of the following is the correct way to assign a role following the least privilege principle in GCP IAM?
easy
A. Assign a predefined role that only allows necessary actions
B. Assign the 'Owner' role to all users for easy management
C. Assign the 'Editor' role to everyone to avoid permission issues
D. Assign no roles and let users request access when needed

Solution

  1. Step 1: Review role assignment options

    Least privilege requires giving only necessary permissions, not broad ones like Owner or Editor.

  2. Step 2: Identify the best practice

    Predefined roles with limited permissions fit least privilege best, so Assign a predefined role that only allows necessary actions is correct.

  3. Final Answer:

    Assign a predefined role that only allows necessary actions -> Option A

  4. Quick Check:

    Least privilege = specific predefined roles [OK]
Hint: Use predefined roles with minimal permissions [OK]
Common Mistakes:
  • Assigning Owner or Editor roles broadly
  • Not using predefined roles
  • Giving no roles and causing delays
3. Consider this IAM policy snippet in GCP:
{
  "bindings": [
    {
      "role": "roles/storage.objectViewer",
      "members": ["user:alice@example.com"]
    }
  ]
}

What access does Alice have?
medium
A. Full control over storage buckets
B. Can view objects in storage buckets
C. Can edit and delete storage objects
D. No access to storage resources

Solution

  1. Step 1: Identify the role assigned

    The role is 'roles/storage.objectViewer', which allows viewing objects only.

  2. Step 2: Understand permissions of the role

    This role grants read-only access to storage objects, no editing or deleting.

  3. Final Answer:

    Can view objects in storage buckets -> Option B

  4. Quick Check:

    objectViewer = read-only access [OK]
Hint: Viewer roles allow read-only access [OK]
Common Mistakes:
  • Confusing viewer with editor or owner roles
  • Assuming viewer can delete or edit
  • Ignoring the specific role name
4. You assigned the 'roles/editor' role to a service account, but it only needs to read data. What is the best fix to follow the least privilege principle?
medium
A. Keep the 'editor' role since it covers all needs
B. Remove the role and do not assign any role
C. Change the role to 'roles/viewer' or a more specific read-only role
D. Assign the 'owner' role for future flexibility

Solution

  1. Step 1: Identify the problem with current role

    'roles/editor' grants broad permissions beyond reading, violating least privilege.

  2. Step 2: Choose a role with minimal needed permissions

    Assigning 'roles/viewer' or a specific read-only role limits access appropriately.

  3. Final Answer:

    Change the role to 'roles/viewer' or a more specific read-only role -> Option C

  4. Quick Check:

    Least privilege = minimal needed permissions [OK]
Hint: Use read-only roles if only reading is needed [OK]
Common Mistakes:
  • Keeping overly broad roles
  • Removing roles entirely causing access failure
  • Assigning owner role unnecessarily
5. You manage a GCP project with multiple teams. One team needs to deploy apps but should not access billing info. How do you apply the least privilege principle?
hard
A. Assign a custom role with deployment permissions but no billing access
B. Assign 'Project Owner' role to the team for full control
C. Assign the 'Project Editor' role to the team and 'Billing Admin' to a few users
D. Give the team billing account access to avoid deployment delays

Solution

  1. Step 1: Understand team needs and restrictions

    The team needs deployment rights but must not access billing info.

  2. Step 2: Choose role assignment following least privilege

    A custom role with only deployment permissions and no billing access fits best.

  3. Final Answer:

    Assign a custom role with deployment permissions but no billing access -> Option A

  4. Quick Check:

    Least privilege = custom roles for precise access [OK]
Hint: Use custom roles to separate duties precisely [OK]
Common Mistakes:
  • Giving broad roles like Owner or Editor
  • Granting billing access unnecessarily
  • Ignoring custom roles for fine control