An enterprise organization is refining access controls to comply with the principle of least privilege across its development environments. The security team needs to grant an operational group the Compute Instance Admin role (roles/compute.instanceAdmin.v1) on a folder containing multiple projects. The access policy must meet the following constraints: Permissions must only apply to Compute Engine VM instances that possess the environment: development Resource Manager tag (either directly attached or inherited). To mitigate security risks, the IAM condition must prevent unintentional permission grants if the tag key or tag value is deleted and subsequently recreated with identical short names but intended for different scopes. Which IAM condition expression should the security engineer attach to the role binding?

resource.matchTagId('tagKeys/123456789012', 'tagValues/567890123456'): What resource.matchTagId() is resource.matchTagId() is an IAM Conditions function that evaluates whether a target resource has a specific Resource Manager tag attached or inherited, referencing the tag key and tag value by their globally unique, immutable permanent resource IDs (e.g., tagKeys/123456789012 and tagValues/567890123456). How it meets the requirements Targeting tagged resources: The expression evaluates to true exclusively for resources that have the specific tag key and tag value pair applied directly or inherited down the resource hierarchy. Preventing unintentional reuse risk: Permanent IDs are generated once by Google Cloud and can never be reused. If a tag key or value is deleted and a new one is created with the exact same display short name (environment: development), the new entity receives a brand-new permanent ID. Consequently, the existing condition will not match the recreated tag, preventing unauthorized or unintended privilege grants. Key advantages and capabilities Immutable security boundaries: Protects sensitive IAM bindings from naming collisions and drift caused by lifecycle changes in tag definitions. Hierarchical evaluation: Automatically factors in tag inheritance across organizations, folders, and projects down to individual Compute Engine instances. Fine-grained authorization: Enforces least-privilege access without requiring manual role grants on every single virtual machine. Auditable identifiers: References definitive numerical IDs that map cleanly to Cloud Audit Logs for compliance verification. Why this is optimal While using short names via resource.matchTag() is convenient for declarative scripting, it carries the inherent risk that recreated tags with the same name automatically inherit historical IAM grants. Using resource.matchTagId() provides the highest level of security assurance against inadvertent privilege assignment.

Iam Conditions Resource Tags Permanent Id | Professional Cloud Security Engineer

StudyCerts

Explanations

What `resource.matchTagId()` is

resource.matchTagId() is an IAM Conditions function that evaluates whether a target resource has a specific Resource Manager tag attached or inherited, referencing the tag key and tag value by their globally unique, immutable permanent resource IDs (e.g., tagKeys/123456789012 and tagValues/567890123456).

How it meets the requirements

Targeting tagged resources: The expression evaluates to true exclusively for resources that have the specific tag key and tag value pair applied directly or inherited down the resource hierarchy.
Preventing unintentional reuse risk: Permanent IDs are generated once by Google Cloud and can never be reused. If a tag key or value is deleted and a new one is created with the exact same display short name (environment: development), the new entity receives a brand-new permanent ID. Consequently, the existing condition will not match the recreated tag, preventing unauthorized or unintended privilege grants.

Key advantages and capabilities

Immutable security boundaries: Protects sensitive IAM bindings from naming collisions and drift caused by lifecycle changes in tag definitions.
Hierarchical evaluation: Automatically factors in tag inheritance across organizations, folders, and projects down to individual Compute Engine instances.
Fine-grained authorization: Enforces least-privilege access without requiring manual role grants on every single virtual machine.
Auditable identifiers: References definitive numerical IDs that map cleanly to Cloud Audit Logs for compliance verification.

Why this is optimal

While using short names via resource.matchTag() is convenient for declarative scripting, it carries the inherent risk that recreated tags with the same name automatically inherit historical IAM grants. Using resource.matchTagId() provides the highest level of security assurance against inadvertent privilege assignment.

View source documentation

Professional Cloud Security Engineer

Iam Conditions Resource Tags Permanent Id