Your company security team manages access control to production systems using an LDAP directory group. How is this access control managed in the Google Cloud production project?

Question

Options

• AAssign the proper role to the Service Account in the project's IAM Policy
• BGrant each user the roles/iam.serviceAccountUser role on a service account that exists in the
• CAssign the proper role to the Google Group in the project's IAM Policy.
• DCreate the project in a folder with the same name as the LDAP directory group.

• A
  4% (1)
• B
  4% (1)
• C
  92% (23)

Explanation

Google Cloud IAM supports assigning roles directly to Google Groups. Using Google Cloud Directory Sync (GCDS), an on-premises LDAP directory group can be synchronized to a Google Group. Assigning the appropriate IAM role to that Google Group in the project's IAM policy means access is controlled centrally via the LDAP group - when a user is added or removed from the LDAP group, their Google Cloud access updates automatically. Option A (Service Account) and Option B (serviceAccountUser role) are for non-human workload identities, not human user group access. Option D (creating a folder) does not control access.

No community discussion yet for this question.