Professional Cloud ArchitectDemo

By Google · Question Mode

QuestionQ215

Designing for security and compliance

You are implementing Firestore for Mountkirk Games. Mountkirk Games wants to provide a new game with programmatic access to a legacy game's Firestore database.

Access must be as restricted as possible. What should you do?

  • A Create a service account (SA) in the legacy game's Google Cloud project, add a second SA in the new game's IAM page, and then give the Organization Admin role to both SAs.
  • B Create a service account (SA) in the legacy game's Google Cloud project, give the SA the Organization Admin role, and then give it the Firebase Admin role in both projects.
  • C Create a service account (SA) in the legacy game's Google Cloud project, add this SA in the new game's IAM page, and then give it the Firebase Admin role in both projects.
  • D Create a service account (SA) in the legacy game's Google Cloud project, give it the Firebase Admin role, and then migrate the new game to the legacy game's project.
Explanation

Service accounts are IAM principals that can be granted roles on project resources, including projects other than the project in which the service account was created. Granting the service account the Firebase Admin role in each relevant project provides Firebase-level administrative access without the organization-wide privileges of the Organization Admin role or a project migration.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!