Your organization has strict requirements to control access to Google Cloud projects.
You need to enable your Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case.
You want to follow Google-recommended practices.
What should you do?
Click on the arrows to vote for the correct answer
A. B. C. D.B.
The recommended approach to control access to Google Cloud projects is by assigning appropriate roles to users or groups. In this scenario, the requirement is to enable Site Reliability Engineers (SREs) to approve requests from the Google Cloud support team when an SRE opens a support case. Therefore, the recommended approach is to add the SREs to the appropriate role that allows them to approve access requests.
Option A suggests adding SREs to the roles/iam.roleAdmin role. However, this is not recommended because the role grants broad access to Google Cloud resources, including the ability to modify IAM policies, create new projects, and view billing information. Granting such broad access to the SREs may not be necessary to fulfill the requirement, and it can increase the risk of unauthorized changes to the resources.
Option B suggests adding SREs to the roles/accessapproval.approver role. This is the recommended approach since the role is specifically designed to grant users permission to approve or deny access requests. Assigning this role to SREs will allow them to approve requests from the Google Cloud support team when an SRE opens a support case while limiting their access to only the necessary resources.
Option C suggests adding SREs to a group and then adding the group to the roles/iam.roleAdmin role. This approach is similar to Option A and should be avoided for the same reasons mentioned earlier.
Option D suggests adding SREs to a group and then adding the group to the roles/accessapproval.approver role. This approach is similar to Option B, which is the recommended approach. Therefore, Option D is also a valid answer.
In summary, the recommended approach to fulfill the requirement of enabling SREs to approve requests from the Google Cloud support team is to add them to the roles/accessapproval.approver role (Option B) or add the group they belong to in the roles/accessapproval.approver role (Option D).