Members (users, groups, service accounts) in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify a user member in a GCP IAM policy binding.

GCP

member = "user:[1]"

Drag options to blanks, or click blank then click option'

[e-mail]

[e-mail]

[e-mail]

[e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Using a group or service account email with the 'user:' prefix.

The prefix user: is used to specify an individual user email in IAM policies.

2fill in blank

medium

Complete the code to specify a service account member in a GCP IAM policy binding.

GCP

member = "[1]:[e-mail]"

Drag options to blanks, or click blank then click option'

Auser

BserviceAccount

Cgroup

Ddomain

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user:' or 'group:' prefix for service accounts.

The prefix serviceAccount: is used to specify a service account in IAM policies.

3fill in blank

hard

Fix the error in the member string to correctly specify a group in a GCP IAM policy.

GCP

member = "[1]:[e-mail]"

Drag options to blanks, or click blank then click option'

Aproject

BserviceAccount

Cuser

Dgroup

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user:' or 'serviceAccount:' prefix for groups.

The prefix group: is required to specify a Google Group as a member in IAM policies.

4fill in blank

hard

Fill both blanks to create a member string for a domain in GCP IAM policy.

GCP

member = "[1]:[2]"

Drag options to blanks, or click blank then click option'

Adomain

Bexample.com

Cuser

DserviceAccount

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user:' or 'serviceAccount:' as prefix for domain members.

The prefix domain: is used to specify all users in a domain, followed by the domain name.

5fill in blank

hard

Fill all three blanks to define a service account member with a specific project in GCP IAM policy.

GCP

member = "[1]:[2]@[3].iam.gserviceaccount.com"

Drag options to blanks, or click blank then click option'

AserviceAccount

Bmy-service-account

Cmy-project

Duser

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'user' instead of 'serviceAccount' prefix.

Mixing up service account name and project ID.

The member string for a service account includes the prefix serviceAccount:, the service account name, and the project ID.

Practice

1. Which of the following is a correct way to specify a user as a member in GCP IAM?

easy

A. user:[e-mail]

B. serviceaccount:[e-mail]

C. group:[e-mail]

D. member:[e-mail]

Solution

1. Step 1: Understand member types in GCP IAM

   GCP IAM requires a prefix to identify the member type, such as user, group, or serviceaccount.

2. Step 2: Identify the correct prefix for a user

   The prefix for an individual user is user:. So the correct format is user:email.

3. Final Answer:

   user:[e-mail] -> Option A

4. Quick Check:

   User members start with 'user:' [OK]

Hint: User members always start with 'user:' prefix [OK]

Common Mistakes:

• Using 'member:' prefix which is invalid
• Confusing group and user prefixes
• Using serviceaccount prefix for users

2. Which of the following is the correct syntax to specify a service account member in GCP IAM?

easy

A. service-account:[e-mail]

B. serviceaccount:[e-mail]

C. group:[e-mail]

D. user:[e-mail]

Solution

1. Step 1: Recall the prefix for service accounts

   Service accounts use the prefix serviceaccount: followed by the full service account email.

2. Step 2: Check each option's prefix

   Only serviceaccount:[e-mail] uses the correct prefix serviceaccount: without hyphens or mistakes.

3. Final Answer:

   serviceaccount:[e-mail] -> Option B

4. Quick Check:

   Service accounts use 'serviceaccount:' prefix [OK]

Hint: Service accounts use 'serviceaccount:' prefix without hyphens [OK]

Common Mistakes:

• Using 'service-account:' with a hyphen
• Using 'user:' prefix for service accounts
• Using incomplete email addresses

3. Given the following IAM policy binding snippet, which member will have access?

{"role": "roles/viewer", "members": ["group:[e-mail]", "user:[e-mail]"]}

medium

A. Only users in the dev-team group and Bob

B. Only Bob

C. Only the dev-team group

D. All users in the project

Solution

1. Step 1: Analyze the members list in the policy

   The members list includes group:[e-mail] and user:[e-mail]. Both are granted the role.

2. Step 2: Understand access granted by group and user members

   All users in the dev-team group plus the individual user Bob have the role permissions.

3. Final Answer:

   Only users in the dev-team group and Bob -> Option A

4. Quick Check:

   Group and user members both get access [OK]

Hint: Group members grant access to all group users [OK]

Common Mistakes:

• Assuming only one member gets access
• Confusing group with user access scope
• Thinking all project users get access

4. You tried to add a member with user:alice to an IAM policy but got an error. What is the likely cause?

medium

A. IAM policy does not support user members

B. Using 'user:' prefix instead of 'group:'

C. Service account email used instead of user email

D. Missing full email address after 'user:' prefix

Solution

1. Step 1: Check the required format for user members

   User members must include the full email address after the user: prefix.

2. Step 2: Identify the error cause

   Using just user:alice is incomplete and causes a format error.

3. Final Answer:

   Missing full email address after 'user:' prefix -> Option D

4. Quick Check:

   User members need full email [OK]

Hint: Always include full email after 'user:' [OK]

Common Mistakes:

• Using only username without domain
• Confusing user and group prefixes
• Assuming IAM rejects user members

5. You want to grant a Cloud Function access to a Pub/Sub topic using a service account. Which member string should you add to the Pub/Sub IAM policy?

hard

A. group:[e-mail]

B. user:[e-mail]

C. serviceaccount:[e-mail]

D. service-account:[e-mail]

Solution

1. Step 1: Identify the correct member type for Cloud Function access

   Cloud Functions use service accounts to access other resources, so the member must be a service account.

2. Step 2: Use the correct prefix for service accounts

   The prefix is serviceaccount: followed by the full service account email.

3. Step 3: Verify the options

   Only serviceaccount:[e-mail] uses the correct prefix and format.

4. Final Answer:

   serviceaccount:[e-mail] -> Option C

5. Quick Check:

   Service accounts use 'serviceaccount:' prefix [OK]

Hint: Use 'serviceaccount:' prefix for Cloud Function identities [OK]

Common Mistakes:

• Using 'user:' prefix for service accounts
• Adding group instead of service account
• Using incorrect prefix with hyphen