Least privilege principle in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign the minimum required role to a user in GCP IAM.

GCP

resource = client.project_iam_policy('projects/my-project')
policy = resource.get()
policy.bindings.append({ 'role': '[1]', 'members': ['user:[e-mail]'] })
resource.set(policy)

Drag options to blanks, or click blank then click option'

Aroles/viewer

Broles/editor

Croles/owner

Droles/compute.admin

Attempts:

3 left

💡 Hint

Common Mistakes

Using roles/owner or roles/editor which grant too many permissions.

Assigning compute.admin role when not needed.

The roles/viewer role grants read-only access, following the least privilege principle by giving only necessary permissions.

2fill in blank

medium

Complete the code to create a custom IAM role with only the necessary permission to read storage buckets.

GCP

custom_role = {
  'title': 'StorageReadOnly',
  'permissions': ['[1]'],
  'stage': 'GA'
}

Drag options to blanks, or click blank then click option'

Astorage.buckets.create

Bstorage.buckets.get

Cstorage.objects.delete

Dstorage.buckets.update

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing permissions that allow modifying or deleting resources.

Confusing bucket permissions with object permissions.

The permission storage.buckets.get allows reading bucket metadata, which is needed for read-only access.

3fill in blank

hard

Fix the error in the policy binding to follow the least privilege principle by assigning the correct role for Pub/Sub topic publishing.

GCP

policy.bindings.append({ 'role': '[1]', 'members': ['serviceAccount:[e-mail]'] })

Drag options to blanks, or click blank then click option'

Aroles/pubsub.subscriber

Broles/pubsub.viewer

Croles/pubsub.publisher

Droles/pubsub.editor

Attempts:

3 left

💡 Hint

Common Mistakes

Using subscriber or viewer roles which do not allow publishing.

Using editor role which grants more permissions than needed.

The roles/pubsub.publisher role grants only the permissions needed to publish messages to a Pub/Sub topic, following least privilege.

4fill in blank

hard

Fill both blanks to create an IAM policy that grants a user read access to BigQuery datasets but no write access.

GCP

policy.bindings.append({ 'role': '[1]', 'members': ['user:[e-mail]'] })
policy.bindings.append({ 'role': '[2]', 'members': ['user:[e-mail]'] })

Drag options to blanks, or click blank then click option'

Aroles/bigquery.dataViewer

Broles/bigquery.dataEditor

Croles/bigquery.jobUser

Droles/bigquery.user

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning dataEditor role which allows write access.

Not assigning jobUser role which is needed to run queries.

roles/bigquery.dataViewer grants read access to datasets, and roles/bigquery.jobUser allows running jobs without write permissions, following least privilege.

5fill in blank

hard

Fill all three blanks to define a firewall rule that allows only SSH access from a specific IP range, following least privilege.

GCP

firewall_rule = {
  'name': 'allow-ssh',
  'allowed': [
    {
      'IPProtocol': '[1]',
      'ports': ['[2]']
    }
  ],
  'sourceRanges': ['[3]']
}

Drag options to blanks, or click blank then click option'

Atcp

B22

C192.168.1.0/24

Dicmp

Attempts:

3 left

💡 Hint

Common Mistakes

Using incorrect protocol like icmp.

Allowing all IP ranges instead of a specific range.

Opening unnecessary ports.

The firewall rule allows tcp protocol on port 22 (SSH) only from the IP range 192.168.1.0/24, limiting access as per least privilege.