Your project uses several pre-emptible Compute Engine VMs that developers must occasionally start and stop for testing. Developers must not be allowed to create, delete, or modify any other Compute Engine resources in the project. What is the simplest way to grant only the required permissions?
Grant the predefined role Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) on the project.
Create a custom role with only compute.instances.start and compute.instances.stop permissions and bind it to the developer group at the project level.
Grant the Owner primitive role on the project to the developer group.
Grant the Viewer primitive role on the project to all developers.
The predefined IAM role Compute Instance Admin (v1) (roles/compute.instanceAdmin.v1) includes permissions to create and delete instances, which exceeds the requirement. The Viewer primitive role does not allow starting or stopping VMs. A custom role lets you include exactly the two permissions-compute.instances.start and compute.instances.stop-without granting additional rights, and assigning it to the developer group at the project level satisfies the least-privilege principle. Granting Owner would provide full project control and is unnecessary.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a custom IAM role in GCP?
Open an interactive chat with Bash
What is the Compute Instance Admin (v1) role?
Open an interactive chat with Bash
What does the principle of least privilege mean in GCP?
Open an interactive chat with Bash
What is a custom role in Google Cloud IAM?
Open an interactive chat with Bash
What is the principle of least privilege in IAM?
Open an interactive chat with Bash
Why can’t predefined roles always meet specific requirements?
Open an interactive chat with Bash
GCP Associate Cloud Engineer
Setting up a cloud solution environment
Your Score:
Report Issue
Bash, the Crucial Exams Chat Bot
AI Bot
Loading...
Loading...
Loading...
Pass with Confidence.
IT & Cybersecurity Package
You have hit the limits of our free tier, become a Premium Member today for unlimited access.
Military, Healthcare worker, Gov. employee or Teacher? See if you qualify for a Community Discount.
Monthly
$19.99
$19.99/mo
Billed monthly, Cancel any time.
3 Month Pass
$44.99
$14.99/mo
One time purchase of $44.99, Does not auto-renew.
MOST POPULAR
Annual Pass
$119.99
$9.99/mo
One time purchase of $119.99, Does not auto-renew.
BEST DEAL
Lifetime Pass
$189.99
One time purchase, Good for life.
What You Get
All IT & Cybersecurity Package plans include the following perks and exams .