Least Privilege IAM Policy Modification for Service Accounts
Short answer
A Request the roles/iam.serviceAccountAdmin role for your user account to gain specific permissions to modify service account IAM policies.
Question
Key Takeaways
Tests understanding of granular IAM roles versus broad administrative roles, specifically identifying that roles/iam.serviceAccountAdmin is the precise least-privilege role for managing service accounts.
Determines the correct role to grant a user permission to modify service account IAM policies in Google Cloud while strictly adhering to the principle of least privilege.
Common mistake: Selecting the Editor or Owner role (C/D), which grants excessive permissions beyond just service account management, violating the least privilege principle.
Expert Analysis
Why the Answer Is Correct
The question requires modifying IAM policies specifically for service accounts. The roles/iam.serviceAccountAdmin role provides the necessary permissions to manage service accounts (create, delete, modify IAM bindings) without granting access to other resources. This aligns perfectly with the principle of least privilege.
Why the Other Options Are Wrong
Options C (Editor) and D (Owner) are overly broad; they grant permissions across all services in the project, not just service accounts. Option B (roles/run.invoker) only allows invoking Cloud Run services but does not provide any capability to modify IAM policies for service accounts.
Community Comment Notes
Community consensus supports option A as the correct choice. As noted by Mr_MIXER007, "You need to gain the permissions to modify IAM policies for service accounts... Request the roles/iam.serviceAccountAdmin role," highlighting the direct link between the task and the specific role.
Exam Strategy
When asked for 'least privilege' regarding a specific resource type, look for the most specific IAM role related to that resource. Avoid broad roles like Project Editor, Owner, or Organization Admin unless explicitly required by the scenario constraints.
Frequently Asked Questions
Why is roles/iam.serviceAccountAdmin better than Editor?
Does roles/run.invoker allow modifying IAM?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Mr_MIXER007 👍 1 Answered AYou need to gain the permissions to modify IAM policies for service accounts while adhering to the principle of least privilege. A (Request the roles/iam.serviceAccountAdmin role for your user account).
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.
Related Analysis
Practice All ACE Questions
Access 84 questions with complete answers and detailed explanations.
View Full ACE Practice Test →