A data analytics team needs to allow a junior data analyst to view and read files within a specific Cloud Storage bucket named sales-reporting-data. The solution must enforce the principle of least privilege by meeting the following constraints: The analyst must only have read access to objects in sales-reporting-data. The analyst must not be able to modify or delete any files or bucket settings. The analyst must not have access to any other buckets or services in the project. Which Identity and Access Management (IAM) configuration should you implement?

Grant the predefined Storage Object Viewer (roles/storage.objectViewer) role on the sales-reporting-data bucket.: ### **What the Predefined Storage Object Viewer Role Is** The **Storage Object Viewer** (`roles/storage.objectViewer`) role is a Google Cloud **predefined role** designed specifically for read-only access to objects within Cloud Storage. It bundles essential permissions such as `storage.objects.get` (to read object data and metadata) and `storage.objects.list` (to list objects within a bucket) without including any administrative or modification permissions. ### **How It Meets the Requirements** - **Read-only object access (✓):** Granting `roles/storage.objectViewer` allows the analyst to list and download data files without providing create, edit, or delete capabilities. - **No modification permissions (✓):** The role does not contain `storage.objects.create`, `storage.objects.delete`, or `storage.buckets.update` permissions, ensuring files and configurations cannot be altered. - **Scoped to a single bucket (✓):** Applying the role directly at the **bucket resource level** ensures the analyst cannot view or access any other buckets in the project. - **Principle of least privilege (✓):** The analyst receives only the exact permissions needed on the exact resource required, minimizing potential security exposure. ### **Key Advantages and Capabilities** - **Granular resource binding:** IAM allows policies to be applied directly to individual storage buckets rather than globally at the project level. - **Predefined role curation:** Predefined roles are managed and maintained by Google Cloud, following security best practices. - **Separation of duties:** Separates object viewing from bucket configuration and object management. - **Audit compliance:** Integrates cleanly with Cloud Audit Logs for tracking object-level read operations. ### **Why This Is Optimal** Applying a focused predefined role at the bucket level directly aligns with Google Cloud security best practices. Unlike basic roles or project-wide assignments, resource-level predefined roles restrict both the **scope of permissions** and the **scope of resources**, fulfilling all security constraints seamlessly.