IAM deny policies in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the effect of the deny policy.

GCP

{
  "denyRule": {
    "deniedPermissions": ["storage.buckets.delete"],
    "denialCondition": {
      "expression": "request.time < timestamp('2025-01-01T00:00:00Z')"
    },
    "[1]": "DENY"
  }
}

Drag options to blanks, or click blank then click option'

Aaction

Beffect

Cpermission

Drole

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'action' instead of 'effect' causes the policy to be invalid.

Confusing 'role' with the effect key.

The key effect defines whether the policy denies or allows the specified permissions. For deny policies, it must be set to DENY.

2fill in blank

medium

Complete the code to specify the permissions to deny in the deny rule.

GCP

{
  "denyRule": {
    "[1]": ["compute.instances.delete", "compute.instances.stop"]
  }
}

Drag options to blanks, or click blank then click option'

AallowedPermissions

Bpermissions

CdeniedPermissions

DblockedActions

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allowedPermissions' which is for allow policies.

Using 'permissions' which is too generic and invalid here.

The key deniedPermissions lists the permissions that the deny policy blocks.

3fill in blank

hard

Fix the error in the condition expression to correctly deny before 2024-12-31.

GCP

{
  "denyRule": {
    "deniedPermissions": ["storage.objects.delete"],
    "denialCondition": {
      "expression": "request.time [1] timestamp('2024-12-31T23:59:59Z')"
    }
  }
}

Drag options to blanks, or click blank then click option'

A<

B!=

C==

D>

Attempts:

3 left

💡 Hint

Common Mistakes

Using '>' which denies after the date instead of before.

Using '==' which only denies at the exact time.

The expression uses < to deny actions before the specified timestamp.

4fill in blank

hard

Fill both blanks to create a deny policy that blocks deleting buckets and objects.

GCP

{
  "denyRule": {
    "[1]": ["storage.buckets.delete"],
    "[2]": ["storage.objects.delete"]
  }
}

Drag options to blanks, or click blank then click option'

AdeniedPermissions

BallowedPermissions

Dpermissions

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allowedPermissions' which is incorrect for deny rules.

Using 'permissions' which is not a valid key here.

Both blanks require the key deniedPermissions to specify the permissions to deny.

5fill in blank

hard

Fill all three blanks to create a deny policy with a condition that denies stopping and deleting compute instances before 2025.

GCP

{
  "denyRule": {
    "[1]": ["compute.instances.stop"],
    "[2]": ["compute.instances.delete"],
    "denialCondition": {
      "expression": "request.time [3] timestamp('2025-01-01T00:00:00Z')"
    }
  }
}

Drag options to blanks, or click blank then click option'

AdeniedPermissions

BallowedPermissions

C<

D>

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'allowedPermissions' which is invalid for deny rules.

Using '>' operator which denies after the date.

Both permission lists use deniedPermissions and the condition uses < to deny before the date.