Least privilege for Terraform service accounts - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to define a service account with a descriptive name.

Terraform

resource "google_service_account" "terraform_sa" {
  account_id   = "[1]"
  display_name = "Terraform Service Account"
}

Drag options to blanks, or click blank then click option'

Aterraform-sa

Buser-account

Cdefault

Dadmin-sa

Attempts:

3 left

💡 Hint

Common Mistakes

Using generic or unrelated account IDs.

Using names that are too long or complex.

The account_id should be a clear identifier like terraform-sa to represent the Terraform service account.

2fill in blank

medium

Complete the code to assign the minimal IAM role for Terraform to manage Compute Engine instances.

Terraform

resource "google_project_iam_member" "terraform_compute_role" {
  project = var.project_id
  role    = "[1]"
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
}

Drag options to blanks, or click blank then click option'

Aroles/compute.instanceAdmin.v1

Broles/editor

Croles/viewer

Droles/owner

Attempts:

3 left

💡 Hint

Common Mistakes

Assigning overly broad roles like 'roles/owner'.

Assigning read-only roles that don't allow changes.

The role roles/compute.instanceAdmin.v1 grants Terraform the least privilege needed to manage Compute Engine instances.

3fill in blank

hard

Fix the error in the IAM binding by completing the role with the correct least privilege for Terraform to manage Cloud Storage buckets.

Terraform

resource "google_project_iam_member" "terraform_storage_role" {
  project = var.project_id
  role    = "[1]"
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
}

Drag options to blanks, or click blank then click option'

Aroles/storage.admin

Broles/storage.objectViewer

Croles/storage.viewer

Droles/storage.objectAdmin

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'roles/storage.admin' which is too broad.

Using 'roles/storage.viewer' which is read-only.

The roles/storage.objectAdmin role allows Terraform to create, update, and delete objects in Cloud Storage buckets, which is the least privilege needed for managing bucket contents.

4fill in blank

hard

Fill both blanks to create a custom IAM role with minimal permissions for Terraform to manage Compute Engine instances.

Terraform

resource "google_project_iam_custom_role" "terraform_custom_role" {
  role_id     = "terraformComputeRole"
  title       = "Terraform Compute Role"
  description = "Custom role with least privilege for Terraform Compute management"
  permissions = [
    "[1]",
    "[2]"
  ]
  project     = var.project_id
}

Drag options to blanks, or click blank then click option'

Acompute.instances.create

Bcompute.instances.delete

Ccompute.instances.start

Dcompute.instances.get

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing permissions that do not allow instance creation or deletion.

Including unnecessary permissions that increase privilege.

The permissions compute.instances.create and compute.instances.delete allow Terraform to create and delete instances, covering essential management actions with least privilege.

5fill in blank

hard

Fill all three blanks to define a minimal IAM policy binding for Terraform service account to manage networking resources.

Terraform

resource "google_project_iam_member" "terraform_network_role" {
  project = var.project_id
  role    = "[1]"
  member  = "serviceAccount:${google_service_account.terraform_sa.email}"
  condition {
    title       = "Limit to VPC networks"
    description = "Restrict permissions to VPC network management"
    expression  = "resource.name.startsWith('projects/${var.project_id}/global/networks/') && resource.type == '[2]' && request.time < timestamp('[3]')"
  }
}

Drag options to blanks, or click blank then click option'

Aroles/compute.networkAdmin

Bcompute.networks

C2025-01-01T00:00:00Z

Droles/compute.viewer

Attempts:

3 left

💡 Hint

Common Mistakes

Using overly broad roles like 'roles/compute.viewer' for management tasks.

Incorrect resource type or timestamp format in the condition.

The role roles/compute.networkAdmin grants Terraform the ability to manage networks. The condition restricts the resource type to compute.networks and limits the permission validity until 2025-01-01T00:00:00Z, enforcing least privilege and time-bound access.