Least privilege for Terraform service accounts - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ security

intermediate

Identify the least privilege IAM role for Terraform to manage Compute Instances

You want to give a Terraform service account permission to create, update, and delete Compute Engine instances only. Which IAM role grants the least privilege for this task?

A roles/editor

B roles/compute.admin

C roles/compute.instanceAdmin.v1

D roles/owner

💡 Hint

Look for the role that limits permissions to managing instances only, not the entire project.

roles/compute.instanceAdmin.v1 allows managing Compute Engine instances without broader project permissions. Other roles like compute.admin or owner have more permissions than needed.

✅ Best Practice

intermediate

Choose the best practice for Terraform service account key management

Which practice is best to securely manage Terraform service account keys?

A Use short-lived credentials and rotate keys regularly, storing them in a secure secrets manager

B Create long-lived service account keys and store them in Terraform code repository

C Share service account keys with all team members via email

D Use the default Compute Engine service account without restrictions

💡 Hint

Think about minimizing risk if keys are exposed.

Short-lived credentials and regular rotation reduce risk. Storing keys in a secure secrets manager prevents accidental exposure. Avoid sharing keys openly or using default accounts with broad permissions.

❓ Configuration

advanced

Determine the Terraform IAM binding for least privilege on Cloud Storage buckets

You want a Terraform service account to only read and write objects in a specific Cloud Storage bucket. Which IAM binding configuration grants the least privilege?

Terraform

resource "google_storage_bucket_iam_member" "terraform_sa_access" {
  bucket = "my-terraform-bucket"
  role   = role
  member = "serviceAccount:[e-mail]"
}

A role = "roles/storage.objectAdmin"

B role = "roles/storage.admin"

C role = "roles/storage.objectViewer"

D role = "roles/storage.objectCreator"

💡 Hint

Consider which role allows both reading and writing objects but not managing the bucket itself.

roles/storage.objectAdmin allows read and write access to objects in the bucket without permissions to manage bucket settings. Other roles either allow only read, only write, or full bucket management.

❓ Architecture

advanced

Select the best architecture to enforce least privilege for Terraform across multiple projects

You manage multiple GCP projects and want Terraform service accounts to have least privilege access only to their assigned projects. What architecture best supports this?

A Use user credentials instead of service accounts for Terraform

B Create separate service accounts per project with scoped IAM roles limited to each project

C Use a single service account with editor role in the organization

D Create one service account with owner role in all projects

💡 Hint

Think about isolating permissions per project to reduce risk.

Separate service accounts per project with scoped roles limit blast radius if credentials are compromised. Using one account with broad roles increases risk. User credentials are not recommended for automation.

❓ service_behavior

expert

What happens if Terraform service account lacks permission to create a resource?

Terraform runs a plan and apply to create a Compute Engine instance, but the service account lacks the required IAM permission. What is the expected behavior?

A Terraform applies changes partially and skips the resource without error

B Terraform silently ignores the missing permission and logs a warning

C Terraform creates the resource with limited features

D Terraform fails the apply step with a permission denied error and stops execution

💡 Hint

Consider how Terraform handles errors during resource creation.

Terraform stops and reports an error if the service account lacks permissions to create a resource. It does not partially apply or silently ignore permission issues.