Professional Data Engineer

By Google · Question Mode

QuestionQ6

Preparing and using data for analysis

The Development and External teams have the Project Viewer Identity and Access Management (IAM) role in a folder called Visualization. You want the Development Team to be able to read data from both Cloud Storage and BigQuery, while the External Team can read data only from BigQuery. What should you do?

Question Image

Explanation

VPC Service Controls is an additional, IAM-independent control layer that can restrict access to specifically protected Google Cloud services. Placing both projects in a perimeter that restricts Cloud Storage, and allowing only the Development Team through an access level, permits that team to access Cloud Storage while blocking the External Team's Cloud Storage requests despite its inherited IAM role. Because BigQuery is not restricted by this perimeter, both teams retain their existing IAM-based BigQuery read access.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!