Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Google Cloud service
IAM
Topic in 4 exam domains
Also called: IAM service
Identity and Access Management service used to control access to resources such as tables in BigQuery.
Where this appears on the exam
4 objectives in 3 of 5 domains
Related topics
FoundationsThis topicWorks alongsideBuilds on theseAppliedApplication Default CredentialsFeatureIdentity and Access ManagementService
IAMService
Cloud StorageServiceBackup and DRServiceStorage Transfer ServiceServiceGKEServiceBigQueryServiceGoogle Cloud consoleFeatureSecret ManagerServiceIdentity-Aware ProxyServicePub/SubServiceWorkload Identity FederationFeatureGoogle SecOpsServiceCompute EngineServiceCloud Run functionsServiceCloud RunServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- Application Default Credentials works with IAM From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- IAM secures BigQuery From the official documentation: “BigQuery uses IAM to manage access to resources.”
- Application Default Credentials secures IAM From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Backup and DR works with IAM From the official documentation: “The following table lists the [IAM](/storage/docs/access-control/iam) permissions that are associated with Backup and DR.”
- BigQuery works with IAM From the official documentation: “BigQuery uses [IAM](/iam) to manage access to resources and provides centralized [access management](/bigquery/docs/access-control) to resources and actions.”
- Cloud Storage works with IAM From the official documentation: “Use IAM and Cloud Storage Terraform resources to create a public Cloud Storage bucket.”
- IAM depends on Application Default Credentials From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- IAM secures Google Cloud console From the official documentation: “For information about the various user roles and getting access control to Google Cloud console see [Access control with IAM](https://cloud.google.com/support/docs/access-control).”
- IAM configures Google SecOps From the official documentation: “If you've already completed Stage 2 of SOAR migration to Google Cloud, you need to use IAM to manage feature access to Google SecOps including SOAR.”
- IAM secures Pub/Sub From the official documentation: “Access control with IAM Learn how Pub/Sub uses IAM for access control.”
- IAM secures Secret Manager From the official documentation: “Access to the Secret Manager API is protected by IAM.”
- Identity-Aware Proxy depends on IAM From the official documentation: “By default, IAP uses Google identities and IAM.”
- Workload Identity Federation is part of IAM From the official documentation: “| Applicable products | IAM | | Path | `iam.googleapis.com/WorkloadIdentityPool` |”
- Application Default Credentials works with Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Application Default Credentials secures BigQuery From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- BigQuery depends on Application Default Credentials From the official documentation: “To authenticate to BigQuery, set up Application Default Credentials.”
- Application Default Credentials works with Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Storage From the official documentation: “External BigQuery data source backed by Cloud Storage”
- Application Default Credentials works with BigQuery From the official documentation: “Create a BigQuery client using application default credentials.”
- Application Default Credentials secures Pub/Sub From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Pub/Sub depends on Application Default Credentials From the official documentation: “To authenticate to Pub/Sub, set up Application Default Credentials.”
- Application Default Credentials works with Secret Manager From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- Cloud Storage works with Google SecOps From the official documentation: “Configure a feed in Google SecOps to ingest from Google Cloud Storage”
- Application Default Credentials works with Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- Application Default Credentials secures Cloud Storage From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Storage depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Storage, set up Application Default Credentials.”
- Cloud Run works with Pub/Sub From the official documentation: “Route Cloud Pub/Sub events to Cloud Run”
- Cloud Run works with Cloud Storage From the official documentation: “Route Cloud Storage events to Cloud Run”
- Cloud Run works with Secret Manager From the official documentation: “You can integrate Secret Manager with other Google Cloud products such as Cloud Run.”
- Cloud Storage works with Storage Transfer Service From the official documentation: “Transfer data between Cloud Storage services such as AWS S3 and Cloud Storage.”
- Application Default Credentials works with Cloud Run functions From the official documentation: “To authenticate to Cloud Run functions, set up Application Default Credentials.”
- Cloud Run functions depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run functions, set up Application Default Credentials.”
- Pub/Sub works with Secret Manager From the official documentation: “Receive notifications via Pub/Sub when Secret Manager resources change.”
- Application Default Credentials secures Compute Engine From the official documentation: “To authenticate to Compute Engine, set up Application Default Credentials.”
- BigQuery is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Cloud Run functions works with Cloud Storage From the official documentation: “Set up functions in response to events in Cloud Storage:”
- Compute Engine is an alternative to GKE From the official documentation: “To use TPU7x, you can use Google Kubernetes Engine (GKE) or Compute Engine.”
- Secret Manager depends on Application Default Credentials From the official documentation: “To authenticate to Secret Manager, set up Application Default Credentials.”
- BigQuery works with Cloud Run functions From the official documentation: “BigQuery supports external function calls through Cloud Run functions.”
- Cloud Run depends on Pub/Sub From the official documentation: “Create a Pub/Sub topic that Cloud Scheduler will publish to and the Cloud Run function will subscribe to.”
- Cloud Run functions works with Pub/Sub From the official documentation: “Use Cloud Run functions to publish messages on Pub/Sub.”
- Compute Engine works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- Identity-Aware Proxy secures Cloud Run From the official documentation: “There are two ways to enable Identity-Aware Proxy for your Cloud Run services.”
- BigQuery works with Pub/Sub From the official documentation: “createBigQuerySubscription creates a Pub/Sub subscription that exports messages to BigQuery.”
- Cloud Run depends on Application Default Credentials From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Cloud Run is an alternative to GKE From the official documentation: “The app uses Cloud SQL, Vertex AI, and either Google Kubernetes Engine (GKE) or Cloud Run.”
- Cloud Run functions depends on Pub/Sub From the official documentation: “The Pub/Sub message triggers Cloud Run functions.”
- GKE works with Secret Manager From the official documentation: “To use Secret Manager with workloads running on Compute Engine or GKE, the underlying instance or node must have the `cloud-platform` OAuth scope.”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- Cloud Storage works with Pub/Sub From the official documentation: “| **Google Cloud** | Cloud Storage | Pub/Sub |”
- Cloud Storage is an alternative to Pub/Sub From the official documentation: “To keep audit logs for a longer period of time or to use more powerful search capabilities, you can route copies of your audit logs to Cloud Storage, BigQuery, or Pub/Sub.”
- Identity and Access Management secures Secret Manager From the official documentation: “Secret Manager uses Identity and Access Management (IAM) for authorization.”
- Identity-Aware Proxy secures Compute Engine From the official documentation: “Securing Compute Engine apps Enable IAP for Compute Engine apps.”
- Application Default Credentials works with Cloud Run From the official documentation: “To authenticate to Cloud Run, set up Application Default Credentials.”
- Application Default Credentials secures Cloud Run functions From the official documentation: “To authenticate to Cloud Run functions, set up Application Default Credentials.”
- Application Default Credentials works with Identity and Access Management From the official documentation: “To authenticate to IAM, set up Application Default Credentials.”
- Cloud Run is an alternative to Cloud Run functions From the official documentation: “To create remote functions, you must [grant required roles](/bigquery/docs/remote-functions#grant_permission_on_function) to Cloud Run functions or Cloud Run.”
- GKE works with Workload Identity Federation From the official documentation: “To allow GitHub Actions authenticate Google Cloud and deploy to GKE, use [workload identity federation](/iam/docs/workload-identity-federation).”
- Identity and Access Management secures BigQuery From the official documentation: “Access to BigQuery data from AlloyDB is managed through IAM.”
How learners score on this topic
Last updated