GCP Professional Data Engineer Practice Question

Your company has a Google Cloud organization with a folder per business unit. Each of those folders contains a child folder named "prod" that holds all production projects. Policy requires that only the central InfoSec group ([email protected]) may create or manage service accounts in production projects, while business-unit admins may keep Owner rights in non-production projects. You must enforce this with minimal ongoing effort and ensure production project owners cannot re-grant themselves the removed permission. What should you do?

Grant roles/iam.serviceAccountAdmin to [email protected] at the organization level and rely on project owners to refrain from assigning it in production.
Attach an IAM deny policy to each business-unit "prod" folder that blocks iam.serviceAccounts.* permissions for all principals except the [email protected] group.
Enable the "Disable Service Account Creation" organization policy constraint and add project-level exceptions for [email protected].
Replace the Owner role in every production project with a custom role that omits iam.serviceAccount.* permissions and assign it to business-unit administrators.

Report Issue

Answer Description

Because IAM allow bindings are inherited down the resource hierarchy, owners of production projects could always add roles that restore their own service-account permissions. An IAM deny policy, however, overrides any existing or future allow bindings. By attaching a single deny policy to each business-unit "prod" folder that blocks iam.serviceAccounts.* for every principal except [email protected], you prevent project owners from creating or managing service accounts, while letting the security group retain that capability. Applying the deny at the organization level would also block development environments, and replacing Owner with per-project custom roles would require high maintenance and still leave room for privilege escalation. The Disable Service Account Creation organization policy cannot include group-level exceptions, so it would over-restrict access.

Ask Bash

Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.