Home › GCP Associate Cloud Engineer › cloudcomputing › gcpsetup › A team wants to grant a contractor read-only acc…
A team wants to grant a contractor read-only access to a single Cloud Storage bucket and nothing else in the project. What's the LEAST-privilege IAM approach?
AGrant the contractor `roles/billing.admin` at the Organization scope
BShare the project's service-account JSON key over email
CGrant the contractor the `roles/storage.objectViewer` role at the BUCKET scope (or via a Conditional binding)
DGrant the contractor `roles/owner` at the Project level so they can browse around
Answer & Solution
Correct answer: C. Grant the contractor the `roles/storage.objectViewer` role at the BUCKET scope (or via a Conditional binding)
Bucket-scoped `storage.objectViewer` gives read-only access exactly where needed. Project Owner or Org-wide Billing Admin grossly over-grant; sharing service-account keys over email is a credential leak and grants way more than read.
Related questions
An organization wants every project in a specific folder to automatically inherit a policyWhich approach correctly captures Google Cloud's quota model for compute resources?Which IAM role type lets you define the exact list of permissions you want, instead of relCloud Identity vs Google Workspace — which statement is correct?A new application needs to call the BigQuery and Cloud Storage APIs in a project. The APIsWhich mechanism on Google Cloud lets a central admin enforce a rule like "no externally acWhich Google Cloud principal type is meant to authenticate workloads (e.g. a Compute EnginWhich Google Cloud Identity and Access Management (IAM) concept defines a SET of permissio