Iam Policy Simulator Replay Troubleshooting

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A security engineer is preparing to remove several broad IAM roles, including roles/editor, from a production project to enforce least privilege across automated workloads. Before applying the updated allow policy, the engineer must validate that the change will not disrupt production services by evaluating the impact against recent historical API access attempts across the project and its child resources.

During an initial command-line test replay, several permissions evaluated to an access state of UNKNOWN_INFO_DENIED with an error indicating missing permissions to retrieve IAM policies.

Which tool should the engineer use, and how should they resolve the evaluation errors?

Run Policy Simulator for Organization Policies (simulate orgpolicy); resolve the errors by assigning the roles/policysimulator.orgPolicyAdmin role at the organization level.

Run IAM Policy Troubleshooter (iam:troubleshoot); resolve the errors by providing explicit conditionContext attributes including resource service and destination IP.

Run IAM Policy Simulator (replay-recent-access); resolve the errors by granting getIamPolicy permissions on ancestor and descendant resources (or an administrative role on a common ancestor).

Run IAM Recommender (gcloud recommender); resolve the errors by activating the Security Command Center IAM Recommender Response playbook.

Professional Cloud Security Engineer

Iam Policy Simulator Replay Troubleshooting

Related questions