Policy troubleshooter in GCP - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the command to start the Policy Troubleshooter for a specific resource.

GCP

gcloud policy-troubleshooter iam troubleshoot [1]

Drag options to blanks, or click blank then click option'

A--resource

B--resource-path

C--resource-id

D--resource-name

Attempts:

3 left

💡 Hint

Common Mistakes

Using '--resource' alone which is not a valid flag.

Confusing resource ID with resource name.

The correct flag to specify the resource name in the Policy Troubleshooter command is --resource-name.

2fill in blank

medium

Complete the command to specify the permission to troubleshoot in Policy Troubleshooter.

GCP

gcloud policy-troubleshooter iam troubleshoot --resource-name=my-resource [1] storage.buckets.get

Drag options to blanks, or click blank then click option'

A--permission

B--role

C--permissions

D--role-name

Attempts:

3 left

💡 Hint

Common Mistakes

Using '--role' instead of '--permission'.

Using plural '--permissions' which is not valid.

The --permission flag is used to specify the permission to check in the Policy Troubleshooter.

3fill in blank

hard

Fix the error in the command to troubleshoot IAM policy for a user.

GCP

gcloud policy-troubleshooter iam troubleshoot --resource-name=my-resource --permission=storage.buckets.get --principal=[1]

Drag options to blanks, or click blank then click option'

Auser=[e-mail]

[e-mail]

Cuser:[e-mail]

Duser [e-mail]

Attempts:

3 left

💡 Hint

Common Mistakes

Omitting the 'user:' prefix.

Using '=' or space instead of ':'.

The principal must be specified with the prefix user: followed by the email address.

4fill in blank

hard

Fill both blanks to troubleshoot IAM policy for a service account and specify the permission.

GCP

gcloud policy-troubleshooter iam troubleshoot --resource-name=my-resource --principal=[1] --permission=[2]

Drag options to blanks, or click blank then click option'

AserviceAccount:[e-mail]

Bstorage.objects.list

Cuser:[e-mail]

Dstorage.buckets.create

Attempts:

3 left

💡 Hint

Common Mistakes

Using a user principal instead of a service account.

Using a permission that does not match the resource.

The principal is a service account with the correct prefix, and the permission is a valid storage permission.

5fill in blank

hard

Fill all three blanks to troubleshoot IAM policy for a user, specify the resource, and the permission.

GCP

gcloud policy-troubleshooter iam troubleshoot [1] --principal=[2] --permission=[3]

Drag options to blanks, or click blank then click option'

A--resource-name=my-bucket

Buser:[e-mail]

Cstorage.objects.get

D--resource-id=my-bucket

Attempts:

3 left

💡 Hint

Common Mistakes

Using '--resource-id' instead of '--resource-name'.

Omitting the 'user:' prefix in the principal.

Using an incorrect permission string.

The resource is specified with --resource-name, the principal is a user with the correct prefix, and the permission is a valid storage permission.