Roles (basic, predefined, custom) in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to assign the basic Viewer role to a user in GCP.

GCP

gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role=[1]

Drag options to blanks, or click blank then click option'

Aroles/viewer

Broles/editor

Croles/owner

Droles/customRole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'roles/editor' which grants edit permissions instead of read-only.

Using 'roles/owner' which grants full control.

Using a custom role name instead of a predefined basic role.

The basic Viewer role is roles/viewer, which grants read-only access.

2fill in blank

medium

Complete the code to assign the predefined Compute Admin role to a service account.

GCP

gcloud projects add-iam-policy-binding my-project --member='serviceAccount:[e-mail]' --role=[1]

Drag options to blanks, or click blank then click option'

Aroles/viewer

Broles/compute.admin

Croles/storage.admin

Droles/logging.viewer

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing storage or logging roles instead of compute roles.

Using basic roles instead of predefined roles for specific services.

The Compute Admin role is roles/compute.admin, which allows full control of Compute Engine resources.

3fill in blank

hard

Fix the error in the custom role creation command by selecting the correct flag for the role ID.

GCP

gcloud iam roles create myCustomRole [1]='myCustomRoleId' --project=my-project --title='My Custom Role' --permissions=storage.buckets.get

Drag options to blanks, or click blank then click option'

A--id

B--role

C--role-id

D--name

Attempts:

3 left

💡 Hint

Common Mistakes

Using '--role' which is for specifying predefined roles.

Using '--id' or '--name' which are not valid flags for this command.

The correct flag to specify the role ID when creating a custom role is --role-id.

4fill in blank

hard

Fill both blanks to create a custom role with the correct permissions and assign it to a user.

GCP

gcloud iam roles create myCustomRole --project=my-project --title='Custom Role' --permissions=[1] && gcloud projects add-iam-policy-binding my-project --member='user:[e-mail]' --role=[2]

Drag options to blanks, or click blank then click option'

Astorage.buckets.get

Broles/myCustomRole

Cstorage.objects.list

Droles/storage.admin

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning a predefined role instead of the custom role.

Using permissions list instead of role name when assigning.

The custom role is created with the permission storage.buckets.get and assigned using roles/myCustomRole.

5fill in blank

hard

Fill all three blanks to list all roles in a project, filter for custom roles, and describe one role.

GCP

gcloud iam roles list --project=my-project --filter='[1]' --format='value(name)' | grep '[2]' | xargs gcloud iam roles describe [3] --project=my-project

Drag options to blanks, or click blank then click option'

Astage:GA

BcustomRoles

Croles/myCustomRole

Dpredefined

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'predefined' instead of 'customRoles' to filter.

Describing role without full name including 'roles/'.

We filter roles by stage GA, grep for 'customRoles' to find custom roles, and describe the specific custom role by its full name.

Practice

1. Which type of Google Cloud role provides broad access across all services with simple permissions like Owner, Editor, and Viewer?

easy

A. Predefined roles

B. Basic roles

C. Custom roles

D. Service accounts

Solution

1. Step 1: Understand role categories

   Google Cloud has three main role types: basic, predefined, and custom.

2. Step 2: Identify broad access roles

   Basic roles like Owner, Editor, and Viewer provide broad access across all services.

3. Final Answer:

   Basic roles -> Option B

4. Quick Check:

   Broad access = Basic roles [OK]

Hint: Basic roles cover broad access across all services [OK]

Common Mistakes:

• Confusing predefined roles with basic roles
• Thinking custom roles are broad by default
• Mixing service accounts with roles

2. Which of the following is the correct way to create a custom role in Google Cloud IAM?

easy

A. Use the gcloud CLI with 'gcloud iam roles create' and specify permissions

B. Assign a predefined role to a user

C. Use the Google Cloud Console to assign a basic role

D. Create a service account with custom permissions

Solution

1. Step 1: Identify how to create custom roles

   Custom roles require specifying exact permissions and are created via CLI or console.

2. Step 2: Match correct command

   The 'gcloud iam roles create' command is used to create custom roles with specific permissions.

3. Final Answer:

   Use the gcloud CLI with 'gcloud iam roles create' and specify permissions -> Option A

4. Quick Check:

   Create custom role = gcloud iam roles create [OK]

Hint: Custom roles need explicit creation with permissions via CLI [OK]

Common Mistakes:

• Confusing assigning roles with creating roles
• Using service accounts to create roles
• Assigning basic roles instead of creating custom ones

3. Given this snippet assigning roles to a user:

gcloud projects add-iam-policy-binding my-project \
  --member='user:[e-mail]' \
  --role='roles/storage.objectViewer'

What type of role is 'roles/storage.objectViewer'?

medium

A. Basic role

B. Custom role

C. Service account role

D. Predefined role

Solution

1. Step 1: Analyze the role name format

   The role name 'roles/storage.objectViewer' follows the predefined role naming pattern.

2. Step 2: Understand role types

   Predefined roles are specific to services and have names like 'roles/serviceName.roleName'.

3. Final Answer:

   Predefined role -> Option D

4. Quick Check:

   roles/storage.objectViewer = Predefined role [OK]

Hint: Predefined roles have service-specific names like roles/service.role [OK]

Common Mistakes:

• Thinking all roles starting with 'roles/' are basic
• Confusing custom roles with predefined roles
• Assuming service accounts have roles

4. A user tries to create a custom role but gets an error. The command used is:

gcloud iam roles create myCustomRole --project=my-project --permissions=storage.buckets.list,compute.instances.create

What is the likely cause of the error?

medium

A. The command is missing the role title and description

B. Permissions must be comma-separated without spaces

C. The project ID is incorrect

D. Custom roles cannot include permissions from multiple services

Solution

1. Step 1: Review required parameters for custom role creation

   Creating a custom role requires a title and description along with permissions.

2. Step 2: Check the command for missing parameters

   The command lacks '--title' and '--description' flags, causing the error.

3. Final Answer:

   The command is missing the role title and description -> Option A

4. Quick Check:

   Missing title/description causes create role error [OK]

Hint: Always include title and description when creating custom roles [OK]

Common Mistakes:

• Assuming permissions from multiple services are invalid
• Ignoring required flags like title and description
• Mistaking project ID errors for permission errors

5. You want to give a team member permission to manage only Compute Engine instances but no other services. Which role type should you assign and why?

hard

A. Custom role with all permissions, to cover all possible needs

B. Basic role Editor, because it covers all services including Compute Engine

C. Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only

D. Basic role Viewer, because it allows managing instances

Solution

1. Step 1: Understand the requirement

   The team member needs permissions only for Compute Engine, not other services.

2. Step 2: Evaluate role types

   Basic roles are broad and cover all services; custom roles require manual permission selection; predefined roles offer service-specific permissions.

3. Step 3: Choose the best fit

   The predefined Compute Engine Admin role grants full Compute Engine permissions without extra access.

4. Final Answer:

   Predefined Compute Engine Admin role, because it limits permissions to Compute Engine only -> Option C

5. Quick Check:

   Service-specific access = Predefined role [OK]

Hint: Use predefined roles for service-specific permissions [OK]

Common Mistakes:

• Using broad basic roles instead of specific predefined roles
• Assigning Viewer role expecting management permissions
• Creating unnecessary custom roles without need