Your organization is establishing security controls for continuous deployment pipelines targeting a critical production Google Cloud project. You need to implement an environment-aware access control mechanism for engineers who trigger and approve production release pipelines to enforce least privilege. The solution must satisfy the following requirements: Permissions to manage and trigger production release resources must only be granted dynamically when requests originate from corporate public IP subnet ranges. The client workstations must be company-managed devices that satisfy required device security posture checks. Access must automatically evaluate on every request without requiring manual administrative intervention or credential rotation. Which approach should you implement?

Conditional Iam Policies Context Aware Access Pipeline | Professional Cloud DevOps Engineer

Conditional Iam Policies Context Aware Access Pipeline

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your organization is establishing security controls for continuous deployment pipelines targeting a critical production Google Cloud project. You need to implement an environment-aware access control mechanism for engineers who trigger and approve production release pipelines to enforce least privilege.

The solution must satisfy the following requirements:

Permissions to manage and trigger production release resources must only be granted dynamically when requests originate from corporate public IP subnet ranges.
The client workstations must be company-managed devices that satisfy required device security posture checks.
Access must automatically evaluate on every request without requiring manual administrative intervention or credential rotation.

Which approach should you implement?

Configure a VPC Service Controls perimeter enclosing the production project, and deploy a Cloud Armor security policy to filter incoming API calls based on device posture headers and corporate IP ranges.

Configure Identity-Aware Proxy (IAP) TCP-forwarding with OS Login two-step verification, and assign permanent project owner roles to the deployer group without IAM condition expressions.

Implement an IAM condition using request.time and resource.type expressions on the pipeline role binding, and trigger a Cloud Function to rewrite the policy with allowed IP addresses during releases.

Create an Access Level in Access Context Manager specifying the corporate IP subnets and device posture requirements, and configure an IAM conditional role binding on the project using the expression request.auth.access_levels.contains('accessPolicies/POLICY_ID/accessLevels/ACCESS_LEVEL_NAME').

Professional Cloud DevOps Engineer

Conditional Iam Policies Context Aware Access Pipeline

Related questions