CloudGuild · Blog · Cheat sheets · Lessons · Certifications
Navigating IAM Roles in Google Cloud
Understanding IAM roles is crucial for Google Cloud projects. Let's break down a common exam question on service account management.
Configuring IAM roles can trip up candidates. Many struggle with distinguishing between roles that allow management versus those that provide limited access. This question tests that knowledge.
The question
You are configuring IAM roles for a new project on Google Cloud. You want to ensure that only a specific user can manage the project's service accounts, while other users can only view them. Which IAM role should you assign to the user?
- A. roles/iam.serviceAccountUser
- B. roles/iam.serviceAccountAdmin
- C. roles/iam.serviceAccountKeyAdmin
- D. roles/iam.serviceAccountViewer
Think before you scroll
Consider the specific requirements: management capabilities versus viewing access. This distinction is crucial for selecting the appropriate IAM role.
The answer
The correct option is B. roles/iam.serviceAccountAdmin. This role grants the user full management capabilities over service accounts, which aligns perfectly with the requirement to manage them.
Why the other options lose
- A. roles/iam.serviceAccountUser: This role allows users to act as service accounts but does not provide management capabilities. It’s focused on usage rather than management.
- C. roles/iam.serviceAccountKeyAdmin: This role allows the user to manage service account keys. It does not grant permissions to manage the service accounts themselves, which is the primary requirement here.
- D. roles/iam.serviceAccountViewer: This role only allows users to view service accounts. It does not meet the requirement of managing them, making it unsuitable for this scenario.
The concept behind it
Understanding IAM roles is essential for configuring access and security within Google Cloud. The roles are designed to provide specific permissions, and knowing which role grants what capabilities can help you make the right choices in various scenarios.
Exam trap to remember
Remember: management roles provide permissions to create, delete, and modify resources, while viewer roles only allow access to view resources. Always match the role to the required capabilities.