You have written a Cloud Function that accesses other Google Cloud resources. You want to secure the environment using the principle of least privilege. What should you do?

Question

Options

• ACreate a new service account that has Editor authority to access the resources. The deployer is
• BCreate a new service account that has a custom IAM role to access the resources. The deployer
• CCreate a new service account that has Editor authority to access the resources. The deployer is
• DCreate a new service account that has a custom IAM role to access the resources. The deployer

• A
  3% (1)
• B
  17% (5)
• C
  7% (2)
• D
  73% (22)

Explanation

The principle of least privilege requires granting only the minimum permissions necessary for a task. A custom IAM role lets you define exactly which permissions the Cloud Function needs - nothing more. The function's service account uses this custom role, limiting its blast radius if compromised. Additionally, the deployer of the function should not need Owner-level access; a more limited role (e.g., Cloud Functions Developer) is sufficient for deployment. Choices A and C both grant the Editor built-in role, which is far too broad and violates least privilege. Choice B uses a custom role (good) but grants the deployer Owner authority (bad - unnecessary and overly permissive). Choice D correctly combines both: custom role for the function's service account and appropriately scoped permissions for the deployer.

No community discussion yet for this question.