IAM Roles for Managing Buckets and Files in Cloud Storage
Question
You are the project owner of a GCP project and want to delegate control to colleagues to manage buckets and files in Cloud Storage.
You want to follow Google- recommended practices.
Which IAM roles should you grant your colleagues?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.B.
As the project owner of a GCP project, you can delegate control to colleagues to manage buckets and files in Cloud Storage by assigning appropriate IAM roles. Google recommends following the principle of least privilege, which means granting the minimum set of permissions required to perform a specific task.
Out of the given options, the most appropriate IAM role for delegating control to manage buckets and files in Cloud Storage is "Storage Object Admin." This IAM role provides the ability to create, delete, view, and edit objects (files) within a bucket, but not to modify the configuration of the bucket itself.
Granting the "Storage Admin" role would be too broad, as it provides the ability to create, delete, view, and edit both buckets and objects, as well as modify their configuration, which is not necessary in this case.
The "Project Editor" role provides the ability to edit all resources within a project, including Cloud Storage buckets and objects, but it also includes access to other project resources like compute instances and databases, which is not required for managing buckets and files.
Finally, the "Storage Object Creator" role provides only the ability to create new objects (files) within a bucket, but not to view, edit or delete existing objects, which is not sufficient for managing buckets and files.
Therefore, the most appropriate IAM role to grant to colleagues for managing buckets and files in Cloud Storage while following Google-recommended practices is "Storage Object Admin."
