Practice Test 2 | Google Cloud Certified Professional Cloud DevOps Engineer | Dumps | Mock Test
You are managing an application that generates many logs in the staging Project. The Company has an organization in GCP, two folders and four projects. The folders are dev and prod, while the projects are dev, test, staging and production. The dev and test projects are in the dev folder and the staging and production projects are in the prod folder. The company wants to generate metrics from the logs for alerting purposes for that application alone.
What IAM solution will help achieve the requirement following the principle of least privilege?
A. Assign the Logs Admin to developers in the in the prod Folder
B. Assign the Logs Configuration Writer to developers in the prod Folder
C. Assign the Logs Admin to developers in the staging Project
D. Assign the Logs Configuration Writer to developers in the staging Project
Corrcet Answer: D
- Option A is incorrect. The Log Admin role is too permissive and if given at Folder it means the developers will have permissions in production projects as well.
- Option B is incorrect. The Logs Configuration Writer role is enough for creating logs-based metrics but assigning it at folder level will give developers access to production project logs.
- Option C is incorrect. The Log Admin role is too permissive.
- Option D is CORRECT. The Logs Configuration Writer role is enough for creating logs-based metrics.
Reference:
Comments are closed, but trackbacks and pingbacks are open.