GCP Associate Cloud Engineer Practice Question 9: Least Privilege Bucket Access
Google Cloud Associate Cloud Engineer · Test 1 · question 9 of 10
A project contains 30 Cloud Storage buckets. A group of data analysts, analysts@example.com, must be able to list and download the objects in exactly one of them, reports-2026. They must not be able to write to that bucket, and they must not see the contents of any other bucket in the project.
Following the principle of least privilege, what should you do?
Show answer and explanation
Answer:
Cloud Storage IAM policies can be set on an individual bucket, not just on the project, and roles/storage.objectViewer grants exactly what the analysts need: view objects and their metadata, and list the objects in the bucket. It contains no write permissions. Binding that predefined role at the bucket level confines the access to reports-2026 and leaves the other 29 buckets untouched, the textbook least-privilege answer.
Option A is a severe over-grant in two directions at once. roles/storage.admin gives full control of objects *and* buckets, including delete and IAM changes, and granting it on the project applies it to all 30 buckets.
Option B is scoped to the whole project and is not limited to Cloud Storage. Basic roles are service-wide legacy roles; roles/viewer at the project level would let the analysts read resources across many services, and it can only be granted at the project level or above, never on a single bucket.
Option D picks a reasonable permission set but the wrong scope. A binding at the organization node is inherited by every folder, project, and bucket in the organization, so the analysts could read objects everywhere. A custom role is also unnecessary here; a predefined role already matches the requirement, and custom roles carry ongoing maintenance as permissions change.
Reference: IAM roles for Cloud Storage