GCP Associate Cloud Engineer Practice Question

Predefined roles such as Storage Object Admin or Storage Admin bundle all storage.objects.* permissions, which include storage.objects.getIamPolicy-violating the security team's restriction. A custom role lets you pick only the necessary permissions (for example, storage.objects.create and storage.objects.delete) and omit the disallowed storage.objects.getIamPolicy. You can then bind that custom role to the analysts' group at the bucket level. Combining IAM conditions with broader roles would still include the prohibited permission, and using ACLs or Uniform bucket-level access does not remove permissions embedded in the predefined roles. Therefore, defining and assigning a custom IAM role is the correct and least-privilege solution.