An external member of your team needs list access to compute images and disks in one of your projects. You want to follow Google-recommended practices when you grant the required permissions to this user. What should you do?
A Create a custom role, and add all the required compute.disks.list and compute.images.list permissions as includedPermissions. Grant the custom role to the user at the project level. B Create a custom role based on the Compute Image User role. Add the compute.disks.list to the includedPermissions field. Grant the custom role to the user at the project level. C Create a custom role based on the Compute Storage Admin role. Exclude unnecessary permissions from the custom role. Grant the custom role to the user at the project level. D Grant the Compute Storage Admin role at the project level. Show Answer Answer Explanation Creating a custom role with only compute.disks.list and compute.images.list permissions follows the principle of least privilege, granting exactly the access needed. Basing a custom role on pre-defined roles (B, C) includes unnecessary additional permissions. Assigning Compute Storage Admin (D) grants excessive permissions beyond what the external user requires.
Community Discussion