An enterprise organization is establishing separation of duties for an automated compliance bot. The bot must continuously audit and remediate Identity and Access Management (IAM) allow policies across multiple Google Cloud projects. The solution must satisfy the following security constraints: Allow the bot to read project-level IAM allow policies and apply updated allow policies. Prevent the bot from reading sensitive application data, creating or deleting cloud infrastructure, or managing project lifecycle settings. Enforce the principle of least privilege by avoiding basic roles and overly broad administrative roles. Which IAM role configuration should the security team grant to the bot?

Grant the predefined Project IAM Admin role (`roles/resourcemanager.projectIamAdmin`) on the target projects.: ### What the Project IAM Admin Role Is The **Project IAM Admin** role (`roles/resourcemanager.projectIamAdmin`) is a specialized predefined IAM role designed for administrative control over identity and access policies at the project level. It provides the essential permissions—such as `resourcemanager.projects.getIamPolicy` and `resourcemanager.projects.setIamPolicy`—required to inspect, update, and manage allow policy bindings without bundling broad infrastructure access. ### How It Meets the Requirements - **Policy Inspection and Remediation**: It supplies the exact permissions needed to retrieve existing allow policies and write modified allow policies directly on the target project resources. - **Separation of Duties**: Unlike basic roles or broad administrative roles, `roles/resourcemanager.projectIamAdmin` decouples policy administration from resource administration. It does not include data plane access permissions or privileges to create, mutate, or delete workload infrastructure (such as Compute Engine VMs or Cloud Storage objects). - **Least Privilege Enforcement**: By using a tailored predefined role instead of basic roles like `Owner` or `Editor`, the bot is restricted purely to authorization management, eliminating unnecessary privilege escalation paths. ### Key Advantages and Capabilities - **Granular Access Control**: Confines permissions strictly to Resource Manager IAM operations. - **Zero Data Plane Exposure**: Prevents automated scripts from reading sensitive workload data contained inside Cloud Storage buckets, BigQuery datasets, or database instances. - **Streamlined Policy Maintenance**: Automatically receives updates from Google Cloud when new Resource Manager policy capabilities are introduced, avoiding custom role maintenance overhead. - **Audit Compliance**: Enforces explicit separation between infrastructure provisioning and access control governance. ### Why This Is Optimal Granting `roles/resourcemanager.projectIamAdmin` directly meets all operational and security specifications without requiring the ongoing maintenance of custom roles, while strictly honoring the principle of least privilege.

StudyCerts

Iam Project Allow Policy Least Privilege | Professional Cloud Security Engineer | StudyCerts

Professional Cloud Security Engineer

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Advanced

Prepare and test your skills

Track Readiness

Set Exam Goal

Iam Project Allow Policy Least Privilege

Section: Managing privileged roles and separation of duties with Identity and Access Management (IAM) roles and permissions.

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

An enterprise organization is establishing separation of duties for an automated compliance bot. The bot must continuously audit and remediate Identity and Access Management (IAM) allow policies across multiple Google Cloud projects.

The solution must satisfy the following security constraints:

Allow the bot to read project-level IAM allow policies and apply updated allow policies.
Prevent the bot from reading sensitive application data, creating or deleting cloud infrastructure, or managing project lifecycle settings.
Enforce the principle of least privilege by avoiding basic roles and overly broad administrative roles.

Which IAM role configuration should the security team grant to the bot?

Grant the predefined Project IAM Admin role (roles/resourcemanager.projectIamAdmin) on the target projects.

Create and grant a custom IAM role containing the resourcemanager.projects.get and resourcemanager.projects.update permissions.

Grant the basic Owner role (roles/owner) on the target projects.

Grant the basic Editor role (roles/editor) combined with the Security Reviewer role (roles/iam.securityReviewer).

Professional Cloud Security Engineer

Iam Project Allow Policy Least Privilege

Related questions