An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder. The access control architecture must satisfy the following constraints: Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console. Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings. Administrators must NOT receive read or write permissions to any non-database services in the projects. What should the security engineer do to enforce the principle of least privilege?

Create a custom IAM role at the folder level that includes the required Cloud SQL permissions—including both `cloudsql.instances.get` and `cloudsql.instances.list`—and bind this role to the database administration group on the `Application-Services` folder.: ### What Custom IAM Roles at the Folder Level Are **IAM Custom Roles** allow security administrators to bundle granular, discrete permissions tailored specifically to workload responsibilities when predefined or basic roles do not meet the principle of **least privilege**. Defining custom roles at the **folder level** ensures that the role definition is inherited and available across all underlying descendant projects within that branch of the **resource hierarchy**. ### How It Meets the Requirements - **Precise least-privilege scoping:** Including only specific Cloud SQL permissions ensures administrators cannot execute privileged actions such as deleting databases, managing SSL certificates, or calling `cloudsql.instances.delete`. - **Console navigation and functionality:** When authoring custom roles for Cloud SQL, including both **`cloudsql.instances.get`** and **`cloudsql.instances.list`** satisfies the prerequisite console dependency, allowing users to view and select instances in the Google Cloud console UI without error. - **Restricting non-database services:** By defining a custom role with service-specific permissions, the role eliminates unwanted read or write access across other Google Cloud products such as Compute Engine, BigQuery, or Cloud Storage. - **Centralized folder inheritance:** Binding the role to the database administration group at the `Application-Services` folder enforces policy consistency across all existing and newly created descendant projects automatically. ### Key Advantages - **Eliminates administrative bloat:** Protects projects from unintentional privilege creep associated with broader predefined roles. - **Avoids permission duplication:** Defining the role once at the folder resource avoids redundant role definitions across multiple individual projects. - **Enforces separation of duties:** Prevents operators from executing unauthorized IAM policy modifications (`setIamPolicy`). ### Why This Is Optimal Creating a targeted custom role at the folder hierarchy level directly achieves the balance between administrative functionality and strict least-privilege governance.

Custom Iam Role Cloudsql Folder Least Privilege | Professional Cloud Security Engineer

Custom Iam Role Cloudsql Folder Least Privilege

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise manages multiple database workloads across several projects located inside a single folder named Application-Services. The security team needs to grant members of the database administration team permissions to inspect and configure Cloud SQL instances across all current and future projects in this folder.

The access control architecture must satisfy the following constraints:

Administrators must be able to view instance configuration details and navigate Cloud SQL resources seamlessly within the Google Cloud console.
Administrators must NOT have permission to delete instances, delete databases, or modify IAM policy bindings.
Administrators must NOT receive read or write permissions to any non-database services in the projects.

What should the security engineer do to enforce the principle of least privilege?

Grant the predefined roles/cloudsql.admin role to the database administration group at the Application-Services folder level.

Create a custom IAM role at the organization level containing only cloudsql.instances.get, and bind it to the database administration group on the Application-Services folder.

Grant the basic roles/editor role to the database administration group on each individual project under the Application-Services folder.

Create a custom IAM role at the folder level that includes the required Cloud SQL permissions—including both cloudsql.instances.get and cloudsql.instances.list—and bind this role to the database administration group on the Application-Services folder.

Professional Cloud Security Engineer

Custom Iam Role Cloudsql Folder Least Privilege

Related questions