Least Privilege IAM Policy Modification for Service Accounts

Managing Identity and Access Management (IAM).

You are managing resources in a Google Cloud project. A new service account needs the ability to invoke a Cloud Run service. You need to gain the permissions to modify IAM policies for service accounts while adhering to the principle of least privilege. What should you do?

  1. Request the roles/iam.serviceAccountAdmin role for your user account. Correct Answer
  2. Request the roles/run.invoker role for your user account.
  3. Request the Editor role for your user account.
  4. Request the Owner role for your user account.
Answer Correct answer: A — Request the roles/iam.serviceAccountAdmin role for your user account to gain specific permissions to modify service account IAM policies.

Community Insight

Tests understanding of granular IAM roles versus broad administrative roles, specifically identifying that roles/iam.serviceAccountAdmin is the precise least-privilege role for managing service accounts.

Determines the correct role to grant a user permission to modify service account IAM policies in Google Cloud while strictly adhering to the principle of least privilege.

Selecting the Editor or Owner role (C/D), which grants excessive permissions beyond just service account management, violating the least privilege principle.

Community Discussion (1 comments)

Mr_MIXER007 👍 1 Selected: A
You need to gain the permissions to modify IAM policies for service accounts while adhering to the principle of least privilege. A (Request the roles/iam.serviceAccountAdmin role for your user account).

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The question requires modifying IAM policies specifically for service accounts. The roles/iam.serviceAccountAdmin role provides the necessary permissions to manage service accounts (create, delete, modify IAM bindings) without granting access to other resources. This aligns perfectly with the principle of least privilege.

Why the Other Options Are Wrong

Options C (Editor) and D (Owner) are overly broad; they grant permissions across all services in the project, not just service accounts. Option B (roles/run.invoker) only allows invoking Cloud Run services but does not provide any capability to modify IAM policies for service accounts.

Community Comment Notes

Community consensus supports option A as the correct choice. As noted by Mr_MIXER007, "You need to gain the permissions to modify IAM policies for service accounts... Request the roles/iam.serviceAccountAdmin role," highlighting the direct link between the task and the specific role.

Exam Strategy

When asked for 'least privilege' regarding a specific resource type, look for the most specific IAM role related to that resource. Avoid broad roles like Project Editor, Owner, or Organization Admin unless explicitly required by the scenario constraints.

Frequently Asked Questions

Why is roles/iam.serviceAccountAdmin better than Editor?

Editor grants full control over all resources in the project. roles/iam.serviceAccountAdmin is scoped only to service account management, adhering to least privilege.

Does roles/run.invoker allow modifying IAM?

No, it only allows invoking (running) the Cloud Run service. It does not include permissions to change IAM policies for any resource.

More ACE FAQ →

Related Analysis

You are troubleshooting a complex application failure. You f

A-Grade

You are managing your company's archival records that are st

A-Grade

You manage IAM policies for your organization’s Google Cloud

A-Grade

Practice All ACE Questions

Access 84 questions with complete answers and detailed explanations.

View Full ACE Practice Test →

← Back to ACE Study Guide