Custom roles creation in GCP - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a custom role in Google Cloud Platform?

A custom role is a set of permissions that you create to fit your specific needs, allowing you to control access more precisely than predefined roles.

beginner

Which GCP service is used to create and manage custom roles?

The Identity and Access Management (IAM) service is used to create and manage custom roles in GCP.

intermediate

What are the three main components you define when creating a custom role?

You define the role ID, title, description, and the list of permissions that the role grants.

beginner

True or False: Custom roles can be created at the project, folder, or organization level in GCP.

True. Custom roles can be created at different levels to control scope and access.

intermediate

Why should you avoid granting overly broad permissions in a custom role?

Granting broad permissions can lead to security risks by giving users more access than needed. It's best to follow the principle of least privilege.

What is the first step when creating a custom role in GCP?

A Create a role ID and title

B Assign the role to a user

C Define the list of permissions

D Enable billing for the project

You start by creating a role ID and title to identify the custom role before adding permissions.

Which GCP IAM level allows you to create a custom role that applies to all projects in an organization?

A Project level

B Folder level

C Organization level

D Billing account level

Creating a custom role at the organization level makes it available across all projects in that organization.

What is a key benefit of using custom roles instead of predefined roles?

A They are free to use

B They automatically update with new permissions

C They require no permissions to create

D They allow precise control over permissions granted

Custom roles let you tailor permissions exactly to your needs, avoiding unnecessary access.

Which of the following is NOT a valid component of a custom role?

A Billing account number

B Role description

C Role ID

D Permissions list

Billing account number is unrelated to defining a custom role.

What principle should you follow when assigning permissions in a custom role?

A Grant all permissions to simplify management

B Grant the least privilege necessary

C Grant permissions based on user preference

D Grant permissions only to admins

The principle of least privilege helps keep your environment secure by limiting access.

Explain the process and key elements involved in creating a custom role in GCP.

Think about what you need to define and where you create the role.

Why is it important to use custom roles instead of predefined roles in some cases?

Consider security and access needs.

Practice

1. What is the main purpose of creating a custom role in Google Cloud Platform?

easy

A. To create virtual machines quickly

B. To automatically assign all permissions to a user

C. To delete existing predefined roles

D. To tailor permissions specifically for your project needs

Solution

1. Step 1: Understand role customization

   Custom roles allow you to pick specific permissions instead of using broad predefined roles.

2. Step 2: Identify the purpose of custom roles

   They help tailor access to exactly what is needed, improving security and management.

3. Final Answer:

   To tailor permissions specifically for your project needs -> Option D

4. Quick Check:

   Custom roles = tailored permissions [OK]

Hint: Custom roles = pick permissions you want [OK]

Common Mistakes:

• Thinking custom roles give all permissions automatically
• Confusing custom roles with deleting roles
• Assuming custom roles create resources

2. Which of the following is the correct gcloud command syntax to create a custom role named myCustomRole in project my-project with the title "My Role" and permission storage.buckets.list?

easy

A. gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA

B. gcloud iam create role myCustomRole --project my-project --title My Role --permissions storage.buckets.list

C. gcloud roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

D. gcloud iam roles add myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list

Solution

1. Step 1: Identify correct gcloud command structure

   The correct command to create a custom role is gcloud iam roles create with flags for project, title, permissions, and stage.

2. Step 2: Match syntax with options

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA matches the correct syntax including --project, --title, --permissions, and --stage flags.

3. Final Answer:

   gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA -> Option A

4. Quick Check:

   Correct gcloud create syntax = gcloud iam roles create myCustomRole --project=my-project --title="My Role" --permissions=storage.buckets.list --stage=GA [OK]

Hint: Use 'gcloud iam roles create' with all flags [OK]

Common Mistakes:

• Using 'gcloud iam create role' instead of 'roles create'
• Missing the --stage flag
• Incorrect flag order or missing equal signs

3. Given this command:

gcloud iam roles create dataViewer --project=my-project --title="Data Viewer" --permissions=bigquery.datasets.get,bigquery.tables.list --stage=ALPHA

What will be the effect of this custom role?

medium

A. Allows users to get dataset metadata and list tables in BigQuery

B. Allows users to create and delete BigQuery datasets

C. Grants full admin access to BigQuery

D. Denies all BigQuery permissions

Solution

1. Step 1: Analyze permissions in the command

   The permissions bigquery.datasets.get and bigquery.tables.list allow reading dataset info and listing tables.

2. Step 2: Understand what these permissions enable

   These permissions let users view dataset metadata and see tables but not modify or delete them.

3. Final Answer:

   Allows users to get dataset metadata and list tables in BigQuery -> Option A

4. Quick Check:

   Permissions = read-only BigQuery access [OK]

Hint: Check permissions list for read or write actions [OK]

Common Mistakes:

• Assuming ALPHA stage means full access
• Confusing get/list with create/delete permissions
• Thinking it grants admin rights

4. You tried to create a custom role with this command:

gcloud iam roles create testRole --project=my-project --title="Test Role" --permissions=compute.instances.start,compute.instances.stop

But it failed. What is the most likely reason?

medium

A. Project ID is incorrect

B. Permissions are invalid for custom roles

C. Missing the --stage flag which is required

D. Role ID cannot contain uppercase letters

Solution

1. Step 1: Check required flags for role creation

   The --stage flag is mandatory when creating custom roles to specify the release stage.

2. Step 2: Identify missing flag in the command

   The command lacks the --stage flag, causing failure.

3. Final Answer:

   Missing the --stage flag which is required -> Option C

4. Quick Check:

   --stage flag required = Missing the --stage flag which is required [OK]

Hint: Always include --stage when creating custom roles [OK]

Common Mistakes:

• Ignoring the required --stage flag
• Assuming permissions are invalid
• Mistaking project ID or role ID format

5. You want to create a custom role that allows users to list storage buckets and read objects but not delete them. Which permissions should you include in your custom role?

hard

A. storage.buckets.list, storage.objects.delete

B. storage.buckets.list, storage.objects.get

C. storage.buckets.create, storage.objects.get

D. storage.buckets.delete, storage.objects.get

Solution

1. Step 1: Identify permissions for listing buckets and reading objects

   storage.buckets.list allows listing buckets, and storage.objects.get allows reading objects.

2. Step 2: Exclude delete permissions

   Do not include any delete permissions to prevent deletion.

3. Final Answer:

   storage.buckets.list, storage.objects.get -> Option B

4. Quick Check:

   List + read, no delete = storage.buckets.list, storage.objects.get [OK]

Hint: Include only list and get permissions, exclude delete [OK]

Common Mistakes:

• Including delete permissions by mistake
• Confusing create with list permissions
• Assuming read includes delete