Your company organizes its Google Cloud resources using a multi-layer hierarchy where projects are grouped under department folders within an organization resource. You need to delegate access administration to the team leads of the Engineering department while adhering to the principle of least privilege. The requirements are: The Engineering team leads must be able to view and manage IAM allow policies for the Engineering folder, with permissions automatically inheriting down to all child folders and projects. The team leads must not receive direct read, write, or administrative access to the underlying data plane and infrastructure resources (such as Compute Engine VMs or Cloud Storage objects). Access administration must follow Google-recommended practices for group-based identity management and operational maintainability. What should you do?

Create a Google Group for the Engineering team leads and grant the Folder IAM Admin role (roles/resourcemanager.folderIamAdmin) to the group on the Engineering folder.: ### What the Folder IAM Admin Role Is The **Folder IAM Admin** (`roles/resourcemanager.folderIamAdmin`) predefined role provides specific administrative permissions to administer IAM policies on folders without bundling broader data plane or general resource administration privileges. ### How It Meets the Requirements - **Policy Management Delegation**: Granting `roles/resourcemanager.folderIamAdmin` on the `Engineering` folder allows leads to modify allow policies across the folder and its descendant resources through hierarchical policy inheritance. - **Least Privilege and Resource Isolation**: Unlike basic roles or broad administrative roles, the **Folder IAM Admin** role specifically allows managing allow policies without granting broad read, write, or execution permissions over workloads, databases, storage objects, or compute instances. - **Operational Governance**: Binding the role to a **Google Group** rather than individual user accounts simplifies lifecycle management, ensuring permissions are updated dynamically when members join or leave the group without modifying the resource's IAM allow policy. ### Key Advantages - **Granular Access Control**: Enforces separation of duties between security administration and data-plane operations. - **Hierarchical Inheritance**: Policies established at the folder level automatically apply down the resource tree to child projects. - **Simplified Auditing**: Centralizes membership within Google Groups, reducing policy drift and administrative complexity. - **Risk Reduction**: Prevents unintentional infrastructure deletion or data exposure by isolating IAM policy permissions from resource control. ### Why This Is Optimal Using the predefined **Folder IAM Admin** role bound to a Google Group at the folder level fulfills the exact functional requirement of delegating IAM policy management while strictly enforcing least privilege and minimizing management overhead.

Iam Folder Level Least Privilege Access | Professional Cloud DevOps Engineer

Iam Folder Level Least Privilege Access

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

Your company organizes its Google Cloud resources using a multi-layer hierarchy where projects are grouped under department folders within an organization resource. You need to delegate access administration to the team leads of the Engineering department while adhering to the principle of least privilege.

The requirements are:

The Engineering team leads must be able to view and manage IAM allow policies for the Engineering folder, with permissions automatically inheriting down to all child folders and projects.
The team leads must not receive direct read, write, or administrative access to the underlying data plane and infrastructure resources (such as Compute Engine VMs or Cloud Storage objects).
Access administration must follow Google-recommended practices for group-based identity management and operational maintainability.

What should you do?

Create a custom IAM role containing only the resourcemanager.projects.setIamPolicy permission and bind it to individual team leads across each project individually.

Assign the Organization Administrator role (roles/resourcemanager.organizationAdmin) directly to individual team lead user accounts on the organization resource.

Create a Google Group for the Engineering team leads and grant the Folder IAM Admin role (roles/resourcemanager.folderIamAdmin) to the group on the Engineering folder.

Create a Google Group for the Engineering team leads and grant the Owner role (roles/owner) to the group on the Engineering folder.

Professional Cloud DevOps Engineer

Iam Folder Level Least Privilege Access

Related questions