Why advanced IAM matters in GCP - Challenge Your Understanding

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding IAM Role Granularity

Which of the following best explains why using very broad IAM roles (like Owner) for all users is a bad practice?

A It makes it easier to manage permissions because everyone has the same access.

B It increases the risk of accidental or malicious changes because users have more permissions than needed.

C It reduces the number of API calls needed to check permissions.

D It automatically encrypts all data in the project.

💡 Hint

Think about what happens if someone has more access than they really need.

Broad roles give users more permissions than necessary, increasing the chance of mistakes or misuse. Principle of least privilege helps reduce this risk.

❓ security

intermediate

Identifying Risky IAM Configurations

Which IAM configuration below creates the highest security risk in a Google Cloud project?

A Granting the 'roles/owner' role to a user who only needs to read logs.

B Granting the 'roles/editor' role to a service account used only by a specific app.

C Granting the 'roles/viewer' role to a user on a single storage bucket.

D Granting the 'roles/logging.viewer' role to a user who monitors logs.

💡 Hint

Consider the principle of least privilege and what each role allows.

Giving Owner role to someone who only needs to read logs grants far more permissions than necessary, increasing risk.

❓ Architecture

advanced

Designing IAM for a Multi-Team Project

You have three teams: Developers, QA, and Operations. Developers need to deploy apps, QA needs to run tests but not deploy, and Operations needs to manage infrastructure but not code. Which IAM setup best fits these needs?

A Assign 'roles/owner' to all teams for simplicity.

B Assign 'roles/editor' to Developers, 'roles/viewer' to QA, and 'roles/owner' to Operations.

C Assign 'roles/viewer' to all teams and escalate permissions when needed.

D Assign custom roles: Developers get deploy permissions, QA get test execution permissions, Operations get infrastructure management permissions.

💡 Hint

Think about giving only the permissions each team needs.

Custom roles allow precise permission assignment matching each team's responsibilities, improving security and efficiency.

❓ service_behavior

advanced

Effect of Over-Permissive IAM on Service Behavior

What is a likely outcome if a service account used by an app has the 'roles/storage.admin' role instead of a more limited role?

A The app can create, delete, and modify all storage buckets and objects, increasing risk if compromised.

B The app automatically encrypts all data stored.

C The app will fail to access storage buckets due to insufficient permissions.

D The app can only read storage buckets but cannot modify them.

💡 Hint

Consider what 'storage.admin' allows compared to limited roles.

'roles/storage.admin' grants full control over storage resources, so if the app or its credentials are compromised, an attacker can cause serious damage.

✅ Best Practice

expert

Implementing Least Privilege with IAM Conditions

You want to allow a user to start Compute Engine instances only during business hours (9am-5pm). Which IAM feature should you use to enforce this?

A Assign the 'roles/compute.instanceAdmin' role without restrictions.

B Use VPC firewall rules to block access outside business hours.

C Use IAM Conditions to restrict the 'compute.instanceAdmin' role to business hours.

D Create a custom role without any time restrictions.

💡 Hint

Think about how to limit permissions based on time.

IAM Conditions allow you to add rules like time-based restrictions to roles, enforcing least privilege dynamically.

Practice

1. What is the main purpose of advanced IAM in Google Cloud?

easy

A. To speed up cloud resource deployment

B. To reduce cloud storage costs automatically

C. To control who can access and modify cloud resources

D. To monitor network traffic in real-time

Solution

1. Step 1: Understand IAM's role in access control

   IAM (Identity and Access Management) is designed to manage who can do what with cloud resources.

2. Step 2: Identify the main goal of advanced IAM

   Advanced IAM focuses on precise control of permissions to protect resources and data.

3. Final Answer:

   To control who can access and modify cloud resources -> Option C

4. Quick Check:

   Advanced IAM = Access control [OK]

Hint: Think: IAM means managing who can do what [OK]

Common Mistakes:

• Confusing IAM with cost management
• Thinking IAM speeds up deployment
• Mixing IAM with network monitoring

2. Which of the following is the correct way to assign a role to a user in GCP IAM policy JSON?

easy

A. "members": "roles/viewer", "role": ["user:[e-mail]"]

B. "role": "user:[e-mail]", "members": ["roles/viewer"]

C. "user": "roles/viewer", "member": "[e-mail]"

D. "members": ["user:[e-mail]"], "role": "roles/viewer"

Solution

1. Step 1: Recall correct IAM JSON structure

   IAM bindings use "role" for the role name and "members" as a list of identities.

2. Step 2: Match correct syntax

   "members": ["user:[e-mail]"], "role": "roles/viewer" correctly places the user in "members" and the role in "role" with proper formatting.

3. Final Answer:

   "members": ["user:[e-mail]"], "role": "roles/viewer" -> Option D

4. Quick Check:

   Role = roles/viewer, Members = user list [OK]

Hint: Remember: role is a string, members is a list [OK]

Common Mistakes:

• Swapping role and members fields
• Using string instead of list for members
• Incorrect key names like 'user' or 'member'

3. Given this IAM policy snippet:

{"bindings": [{"role": "roles/editor", "members": ["user:[e-mail]"]}]}

What access does Bob have?

medium

A. Edit access to most resources but not billing

B. Full control including billing management

C. Read-only access to all resources

D. No access until granted explicitly

Solution

1. Step 1: Understand the role 'roles/editor'

   The 'editor' role allows editing most resources but excludes billing and owner-level permissions.

2. Step 2: Match Bob's access

   Bob is assigned 'roles/editor', so he can edit resources but cannot manage billing or ownership.

3. Final Answer:

   Edit access to most resources but not billing -> Option A

4. Quick Check:

   roles/editor = edit access without billing [OK]

Hint: Editor role means edit, not full control [OK]

Common Mistakes:

• Confusing editor with viewer role
• Assuming editor includes billing rights
• Thinking editor means no access

4. You wrote this IAM policy JSON but it fails to apply:

{"bindings": [{"role": "roles/viewer", "members": "user:[e-mail]"}]}

What is the error?

medium

A. The 'role' field is misspelled

B. The 'members' field should be a list, not a string

C. The user email format is incorrect

D. The JSON is missing a closing bracket

Solution

1. Step 1: Check 'members' field type

   IAM policy requires 'members' to be a list of strings, not a single string.

2. Step 2: Identify the error in the JSON snippet

   Here, 'members' is given as a string instead of a list, causing the failure.

3. Final Answer:

   The 'members' field should be a list, not a string -> Option B

4. Quick Check:

   Members must be list [OK]

Hint: Members always need brackets [] in JSON [OK]

Common Mistakes:

• Using string instead of list for members
• Ignoring JSON syntax rules
• Assuming user email format is wrong

5. You want to give a team member access to only start and stop virtual machines but not delete or create them. Which IAM approach is best?

hard

A. Create a custom role with only 'start' and 'stop' permissions

B. Give the 'roles/editor' role for full editing rights

C. Assign the 'roles/viewer' role and let them request changes

D. Assign the predefined 'roles/compute.instanceAdmin' role

Solution

1. Step 1: Understand predefined roles limits

   'roles/compute.instanceAdmin' and 'roles/editor' provide broad permissions including create and delete, which is too much.

2. Step 2: Use custom role for precise permissions

   Creating a custom role with only 'start' and 'stop' VM permissions limits access exactly as needed.

3. Final Answer:

   Create a custom role with only 'start' and 'stop' permissions -> Option A

4. Quick Check:

   Custom role = precise access control [OK]

Hint: Use custom roles for exact permission needs [OK]

Common Mistakes:

• Using broad predefined roles without restriction
• Assuming viewer role allows start/stop
• Giving editor role grants too many rights