Your company is designing the access control architecture for its production Google Cloud environment. To comply with regulatory standards and enforce separation of duties, the organization must establish strict administrative isolation. The security policy mandates the following requirements: The Cloud Security Administration team must be able to assign, update, and audit IAM access policies across project resources. The Cloud Security Administration team must NOT have direct operational access to view, create, modify, or delete workload data or provision runtime infrastructure (such as Compute Engine instances or Cloud Storage objects). Access must be scalable and manageable according to Google Cloud identity best practices. Which IAM role configuration should you implement to satisfy these requirements?

Assign the Project IAM Admin (`roles/resourcemanager.projectIamAdmin`) role to a dedicated Google Group containing the security administrators: ### What the Project IAM Admin Role Is The **Project IAM Admin** (`roles/resourcemanager.projectIamAdmin`) role is a predefined Identity and Access Management role in Google Cloud. It provides permissions to administer allow policies and manage IAM access controls at the project level without granting direct access to resource workloads or data planes. ### How It Meets the Requirements - **Administrative Isolation**: Assigning `roles/resourcemanager.projectIamAdmin` allows security administrators to manage role bindings, update allow policies, and control access delegation without inheriting operational privileges to interact with workload data or modify runtime resources. - **Prevents Over-Privileged Access**: Unlike broad basic roles, it isolates the control plane administrative duty (IAM policy management) from operational resources such as Compute Engine instances, Cloud Storage buckets, and BigQuery datasets. - **Scalable Group-Based Management**: Assigning the role to a **Google Group** aligns with identity management best practices, streamlining auditing and access onboarding without editing project allow policies directly for individual users. ### Key Advantages and Capabilities - **Granular Control Plane Management**: Grants `resourcemanager.projects.getIamPolicy` and `resourcemanager.projects.setIamPolicy` specifically. - **Prevents Lateral Movement**: Restricts administrative personnel from directly reading customer data or altering runtime application states. - **Operational Efficiency**: Eliminates overhead by managing team membership centrally within an identity provider or Google Groups. - **Audit Alignment**: Simplifies compliance audits by maintaining distinct boundaries between infrastructure operators and access governors. ### Why This Is Optimal Using `roles/resourcemanager.projectIamAdmin` bound to a group isolates administrative policy functions from data plane access. It avoids the excessive operational power of basic roles like Owner while satisfying strict separation of duties.