Policy Analyzer Effective Iam Access Paths

Worked example. The correct answer is already marked and every option is explained below, so there is nothing to select here. To answer questions yourself, start the free trial.

A multinational financial services enterprise is preparing for an annual regulatory compliance audit. The security engineering team needs to determine every principal—including individual users, nested Google Groups, and service accounts—that possesses effective storage.objects.get or storage.objects.setIamPolicy permissions on specific sensitive Cloud Storage buckets across multiple production projects.

Access to these buckets may be granted directly at the bucket level, inherited from parent folders or the organization root, or granted indirectly through custom IAM roles and group memberships.

Which approach should the security engineering team use to evaluate these effective access paths with minimal operational overhead?

Execute an IAM policy analysis query using Policy Analyzer with the organization as the scope, specifying the target Cloud Storage buckets and the required permissions while enabling identity and role expansion.

Configure IAM Recommender to review least-privilege suggestions for Cloud Storage service accounts and export the recommendations to BigQuery.

Create a Cloud Asset Inventory real-time feed filtering for storage.googleapis.com/Bucket asset creations and export changes to Pub/Sub.

Run the gcloud storage buckets get-iam-policy command recursively across all production projects and parse the output with a script.

Professional Cloud Security Engineer

Policy Analyzer Effective Iam Access Paths

Related questions