Build and operate the data processing systems behind analytics and ML on Google Cloud, including BigQuery, Dataflow, and Pub/Sub, and track your readiness for the Professional Data Engineer exam.
Advanced
Prepare and test your skills
Advanced
Prepare and test your skills
Concept
IAM policy
Topic in 1 exam domain
- IAM policy · Concept
- IAM Policy · Concept · Compute Engine resource policy
Also called: access control policy, bucket IAM policy, bucket-level policy, Cloud IAM policy, IAM access control policies, IAM policies, IAM policies on buckets, IAM policy with conditional role bindings, Policy file, topic IAM policy
A policy file that contains role bindings, used to grant and verify roles for instances or namespaces.
Where this appears on the exam
1 subdomain in 1 of 5 domains
Related topics
FoundationsThis topicBuilds on theseBuilds on theseBuilds on theseBuilds on theseBuilds on theseAppliedIdentity and Access ManagementServiceVPC Service ControlsFeature
IAM policyConcept
Cloud Billing accountConcepttaxonomyConceptprojectConceptCloud StorageServicefolderConceptGoogle SecOpsServiceBigQueryServiceIAM rolesConceptservice accountConceptCloud Storage bucketConceptBigtableServicePoints to what builds on itWorks with or alternative toHover or tap a line to see what connects the two
- IAM policy configures Cloud Billing account From the official documentation: “Set the IAM policy for a Cloud Billing account.”
- IAM policy configures Cloud Storage From the official documentation: “Access to new buckets is managed using IAM policies instead of<br>[Cloud Storage Access control lists (ACLs)](/storage/docs/access-control/lists).”
- IAM policy configures folder From the official documentation: “Set IAM policy for a folder.”
- IAM policy configures IAM roles From the official documentation: “When you add a new member to your project, you can use an [Identity and Access Management (IAM)](/iam) policy to give that member one or more IAM roles to control the actions that the member can perform in Migration Center.”
- IAM policy is part of Identity and Access Management From the official documentation: “IAM lets you control **who (users)** has **what access (roles)** to **which resources** by setting IAM policies.”
- IAM policy is part of project From the official documentation: “Removes a policy binding to the IAM policy of a project, given a project ID and the binding.”
- IAM policy configures taxonomy From the official documentation: “Set the IAM policy for a Policy Tag taxonomy.”
- BigQuery is an alternative to Cloud Storage From the official documentation: “The `import_result_sink` must be a Cloud Storage path or a BigQuery table.”
- BigQuery works with Cloud Storage From the official documentation: “Sample to load Avro data from Cloud Storage into a new BigQuery table”
- VPC Service Controls secures BigQuery From the official documentation: “BigQuery data is protected with VPC Service Controls”
- BigQuery works with Bigtable From the official documentation: “BigQuery lets you query your Bigtable data from BigQuery.”
- Cloud Storage works with Google SecOps From the official documentation: “Google SecOps uses a unique service account to read data from your GCS bucket.”
- BigQuery works with Google SecOps From the official documentation: “Google SecOps can export detailed `ingestion_metrics` tables to your BigQuery dataset.”
- Cloud Storage bucket is part of Cloud Storage From the official documentation: “Create a Google Cloud Storage bucket”
- IAM roles is part of Identity and Access Management From the official documentation: “IAM roles give the principals permissions to perform tasks on your App Topology resources.”
- Identity and Access Management secures Cloud Storage From the official documentation: “Cloud Storage uses Identity and Access Management (IAM) for authorization.”
- project is part of folder From the official documentation: “Folders can contain sub-folders and projects.”
- service account is part of Identity and Access Management From the official documentation: “Service accounts function as both principals and resources within IAM.”
- VPC Service Controls secures Cloud Storage From the official documentation: “Storage Transfer Service supports transfers to Cloud Storage buckets protected by VPC Service Controls.”
- BigQuery works with Identity and Access Management From the official documentation: “BigQuery uses Identity and Access Management (IAM) for authorization.”
- Bigtable is an alternative to Cloud Storage From the official documentation: “If the joining data is in the gigabyte or terabyte range, use either Bigtable or Cloud Storage to merge the joining data to the driving data, depending on the nature of the data.”
- Cloud Storage works with service account From the official documentation: “The service account can manage objects in the Cloud Storage bucket.”
- Google SecOps depends on Cloud Storage From the official documentation: “Google SecOps uses a unique service account to read data from your GCS bucket.”
- IAM roles configures service account From the official documentation: “2. [Grant the necessary Identity and Access Management roles](#grant-iam-roles) to your service account.”
- Identity and Access Management works with VPC Service Controls From the official documentation: “VPC Service Controls perimeters and Identity and Access Management (IAM) roles work together.”
- project depends on Cloud Billing account From the official documentation: “A project and its service-level resources are always paid for by a single billing account.”
- BigQuery works with Cloud Billing account From the official documentation: “In your BigQuery dataset, your Cloud Billing account pricing data is loaded into a data table named `cloud_pricing_export`.”
- BigQuery depends on Cloud Storage From the official documentation: “BigQuery relies on Cloud Storage for staging file data and supports reading from and writing to several other sources and Google Cloud services.”
- BigQuery works with Cloud Storage bucket From the official documentation: “BigQuery lets you load [Datastore](/datastore) entities from a Cloud Storage bucket into a BigQuery table for analysis.”
- BigQuery works with service account From the official documentation: “The service account can be used by services, such as Cloud Run, to read and modify data in the BigQuery dataset.”
- BigQuery works with VPC Service Controls From the official documentation: “BigQuery integrates with VPC Service Controls to restrict access to your BigQuery resources from specific networks.”
- Bigtable works with Cloud Storage From the official documentation: “For example, if you frequently write data to Bigtable from a Cloud Storage bucket in the `us-central1` (Iowa) region, create your Bigtable cluster in a zone within `us-central1`.”
- Cloud Billing account works with project From the official documentation: “A Cloud Billing account defines who pays for a given set of resources, and it can be linked to one or more projects.”
- Cloud Storage works with Identity and Access Management From the official documentation: “To learn how to use IAM with Cloud Storage, see [Using IAM Permissions](/storage/docs/access-control/using-iam-permissions).”
- Cloud Storage is part of project From the official documentation: “All of your Google Cloud resources belong to a project, including Cloud Storage resources like buckets and objects.”
- folder is part of Cloud Storage From the official documentation: “The folder and its contents, including stored objects and other managed folders, are deleted from your Cloud Storage bucket.”
- IAM roles secures Bigtable From the official documentation: “Access to your Bigtable tables is controlled by your Google Cloud project and the [Identity and Access Management (IAM) roles](/bigtable/docs/access-control#roles) that you assign to users.”
- IAM roles secures Cloud Storage From the official documentation: “**Fine-grained access control**: Control agent access to Cloud Storage precisely using [IAM roles](/storage/docs/access-control/iam-roles).”
- IAM roles configures Cloud Storage bucket From the official documentation: “Provide your instance with the `storage.objectAdmin` and `objectViewer` [IAM roles](/storage/docs/access-control/iam-roles) for your bucket.”
- IAM roles is part of Google SecOps From the official documentation: “The Google SecOps platform supports predefined IAM roles as well as custom roles, which you can add as needed.”
- IAM roles works with service account From the official documentation: “In this section, you designate the service account for the gateway proxies and assign them the correct IAM roles.”
- Identity and Access Management secures BigQuery From the official documentation: “Security in BigQuery is intrinsically linked to [Identity and Access Management (IAM)](/iam/docs/overview) in Google Cloud.”
- Identity and Access Management secures Bigtable From the official documentation: “Bigtable uses Identity and Access Management (IAM) for authorization.”
- Identity and Access Management configures Cloud Storage bucket From the official documentation: “You can use [Identity and Access Management (IAM)](/storage/docs/access-control/iam) to control access to individual buckets.”
- Identity and Access Management secures Cloud Storage bucket From the official documentation: “These modifications to that file define a second backup repository in a Cloud Storage bucket, accessed through Identity and Access Management (IAM).”
- Identity and Access Management secures Google SecOps From the official documentation: “You create IAM policies that define which users and groups have access to Google SecOps features.”
- Identity and Access Management configures service account From the official documentation: “Learn more about using Identity and Access Management to [create a service account](/iam/docs/creating-managing-service-accounts) and [manage the access granted to a service account](/iam/docs/granting-changing-revoking-access).”
- service account depends on BigQuery From the official documentation: “Each feature view uses a service account to access the source data in BigQuery during sync.”
- service account is part of Google SecOps From the official documentation: “Each Google SecOps instance has a unique service account.”
- service account is part of project From the official documentation: “Service accounts are created within a project and have a unique email address that identifies them.”
- VPC Service Controls secures Bigtable From the official documentation: “You can use [VPC Service Controls](/vpc-service-controls/docs/overview) to control access to Bigtable instances from outside of approved networks.”
- VPC Service Controls secures project From the official documentation: “You can use VPC Service Controls to create a perimeter around your in-scope CDE projects.”
How learners score on this topic
Last updated