An enterprise organization is establishing a standardized self-service provisioning and access management workflow for engineering teams in Google Cloud. The cloud architecture team must implement an access lifecycle model that meets the following security and governance requirements: Developers must be able to discover and request workload access through a self-service workflow with approval and justification. Access must automatically lapse after a defined time window to maintain Zero Standing Privileges (ZSP) and prevent privilege accumulation. Direct role assignments to individual user identities must be avoided across all environments. Automated project provisioning workflows must prevent services from receiving default, overly permissive roles such as roles/editor upon creation. Which combination of IAM and governance controls should you implement?

Manage access using workload-specific access groups integrated with a Just-In-Time (JIT) self-service tool with auto-expiring memberships, assign IAM roles to these groups, and enforce the `constraints/iam.automaticIamGrantsForDefaultServiceAccounts` organization policy constraint.: What Workload Access Groups and JIT Lifecycle Management Are Workload-specific access groups and Just-In-Time (JIT) group management tools provide a scalable, self-service mechanism for governing permissions across Google Cloud resources. Instead of binding IAM roles directly to individual users, roles are assigned to dedicated access groups representing specific job functions. A self-service tool (such as JIT Groups) evaluates access requests, enforces justification and approval workflows, and automatically expires user memberships when the approved duration concludes. How It Meets the Requirements Self-service discovery and approvals: Dedicated access group management tools allow developers to discover workload groups, submit business justifications, and route requests to designated workload owners for approval. Zero Standing Privileges (ZSP): Auto-expiring group memberships add friction to long-term access retention, automatically revoking user membership and preventing gradual privilege creep over time. Group-based role assignment: Assigning IAM roles to access groups rather than individual user identities simplifies auditing and adheres to foundational IAM best practices. Preventing overly permissive defaults: Enforcing the iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint disables the automatic assignment of roles/editor when new services or projects are provisioned. Key Advantages Reduced administrative overhead: Workload owners manage group membership approvals without needing administrative IAM privileges on the project hierarchy. Comprehensive audit trail: JIT tooling captures access request justifications, approver IDs, and timestamps in central audit logs. Enforced least privilege: Prevents newly created service accounts from acquiring broad default project permissions. Automated decommissioning of access: Timed membership revocation ensures access terminates automatically without requiring manual deprovisioning scripts. Why This Is Optimal Combining JIT-managed access groups with organization policy constraints establishes a secure, repeatable self-service model. It enforces least-privilege access during runtime and guarantees baseline guardrails are inherited by every newly provisioned project.

StudyCerts

Professional Cloud Architect

Intrigued by the art of cloud architecture? Discover how to design, develop, and manage robust, secure, scalable, and dynamic solutions on Google Cloud as you prepare for the Professional Cloud Architect exam!

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Self Service Access Lifecycle Iam Governance

Section: Service catalog and provisioning

An enterprise organization is establishing a standardized self-service provisioning and access management workflow for engineering teams in Google Cloud. The cloud architecture team must implement an access lifecycle model that meets the following security and governance requirements:

Developers must be able to discover and request workload access through a self-service workflow with approval and justification.
Access must automatically lapse after a defined time window to maintain Zero Standing Privileges (ZSP) and prevent privilege accumulation.
Direct role assignments to individual user identities must be avoided across all environments.
Automated project provisioning workflows must prevent services from receiving default, overly permissive roles such as roles/editor upon creation.

Which combination of IAM and governance controls should you implement?

Assign IAM roles directly to individual developer accounts using IAM Conditions with scheduled expiration timestamps, while allowing default service account provisioning during project creation.

Manage access using workload-specific access groups integrated with a Just-In-Time (JIT) self-service tool with auto-expiring memberships, assign IAM roles to these groups, and enforce the constraints/iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint.

Utilize Cloud Identity Groups for Business collaboration groups for IAM role assignments, and delegate group creation and membership management directly to all developers without approval guardrails.

Grant standing primitive Owner roles to developers via a central infrastructure pipeline, and schedule automated nightly scripts to delete and recreate project IAM policies.

Professional Cloud Architect

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Intermediate

Prepare and test your skills

Track Readiness

Set Exam Goal

Self Service Access Lifecycle Iam Governance

Section: Service catalog and provisioning

Developers must be able to discover and request workload access through a self-service workflow with approval and justification.
Access must automatically lapse after a defined time window to maintain Zero Standing Privileges (ZSP) and prevent privilege accumulation.
Direct role assignments to individual user identities must be avoided across all environments.
Automated project provisioning workflows must prevent services from receiving default, overly permissive roles such as roles/editor upon creation.

Which combination of IAM and governance controls should you implement?

Assign IAM roles directly to individual developer accounts using IAM Conditions with scheduled expiration timestamps, while allowing default service account provisioning during project creation.

Utilize Cloud Identity Groups for Business collaboration groups for IAM role assignments, and delegate group creation and membership management directly to all developers without approval guardrails.

Grant standing primitive Owner roles to developers via a central infrastructure pipeline, and schedule automated nightly scripts to delete and recreate project IAM policies.

Explanations

What Workload Access Groups and JIT Lifecycle Management Are

Workload-specific access groups and Just-In-Time (JIT) group management tools provide a scalable, self-service mechanism for governing permissions across Google Cloud resources. Instead of binding IAM roles directly to individual users, roles are assigned to dedicated access groups representing specific job functions. A self-service tool (such as JIT Groups) evaluates access requests, enforces justification and approval workflows, and automatically expires user memberships when the approved duration concludes.

How It Meets the Requirements

Self-service discovery and approvals: Dedicated access group management tools allow developers to discover workload groups, submit business justifications, and route requests to designated workload owners for approval.
Zero Standing Privileges (ZSP): Auto-expiring group memberships add friction to long-term access retention, automatically revoking user membership and preventing gradual privilege creep over time.
Group-based role assignment: Assigning IAM roles to access groups rather than individual user identities simplifies auditing and adheres to foundational IAM best practices.
Preventing overly permissive defaults: Enforcing the iam.automaticIamGrantsForDefaultServiceAccounts organization policy constraint disables the automatic assignment of roles/editor when new services or projects are provisioned.

Key Advantages

Reduced administrative overhead: Workload owners manage group membership approvals without needing administrative IAM privileges on the project hierarchy.
Comprehensive audit trail: JIT tooling captures access request justifications, approver IDs, and timestamps in central audit logs.
Enforced least privilege: Prevents newly created service accounts from acquiring broad default project permissions.
Automated decommissioning of access: Timed membership revocation ensures access terminates automatically without requiring manual deprovisioning scripts.

Why This Is Optimal

Combining JIT-managed access groups with organization policy constraints establishes a secure, repeatable self-service model. It enforces least-privilege access during runtime and guarantees baseline guardrails are inherited by every newly provisioned project.

View source documentation

Professional Cloud Architect

Self Service Access Lifecycle Iam Governance

Professional Cloud Architect

Self Service Access Lifecycle Iam Governance

What Workload Access Groups and JIT Lifecycle Management Are

How It Meets the Requirements

Key Advantages

Why This Is Optimal

Related questions

BigQuery ML ML.PREDICT