What's changed: Created Associate Cloud Engineer Chapter 5 (Domain 5 "Configuring access and security": IAM policies and roles = basic/predefined/custom roles, least privilege; service accounts = creation/least privilege/assigning to resources/impersonation/short-lived credentials).
5.1IAM policies and roles
Understand the core of Google Cloud access control: viewing and creating IAM policies, the difference and selection among basic, predefined, and custom roles, and designing access along the principle of least privilege.
The center of access and security is Cloud IAM. Chapter 1 gave the overview; here we go deeper into role types and least-privilege design.
5.1.1Three kinds of roles
| Role type | What it is | When to use |
|---|---|---|
| Basic roles | Viewer/Editor/Owner (broad) | Limited (e.g., testing); discouraged in prod |
| Predefined roles | Curated per-service permissions | The usual choice |
| Custom roles | Bundle only needed permissions | When predefined is too much/little |
An IAM policy binds roles to members; view/create it in the console or gcloud. Roles include basic roles (Viewer/Editor/Owner)—too broad and discouraged in production—predefined roles with curated per-service permissions, and custom roles bundling only needed permissions. The principle is least privilege—grant only the minimum needed for the job. In practice: "consider predefined first; use custom if it is too much or too little; avoid basic roles."
Common: situation → role. E.g., "grant appropriate per-service permissions quickly" = predefined role; "predefined is too much/little" = custom role; "Viewer/Editor/Owner are too broad" = basic roles (discouraged in prod); "only the minimum" = least privilege; "binding roles to members" = IAM policy.
Watch the mix-ups: (1) basic roles (broad) are discouraged in prod—use predefined/custom. (2) predefined (service-standard) vs custom (self-built, minimized). (3) Enforce least privilege; do not hand out Owner/Editor casually.
5.1.2Section summary
- IAM policy = bind roles to members; three kinds: basic/predefined/custom
- In prod avoid basic roles; predefined (standard) → custom if needed, for least privilege
- Principle is least privilege—grant only the minimum needed for the job
Sign in to track progress — Log in.
Quick check
(just a quick review)Q1. To quickly grant appropriately curated permissions for a specific service, which role type is best?
Q2. When predefined roles are too much or too little, to bundle only needed permissions, what do you use?
Q3. Which roles should be avoided in production access design?
Q4. What is the basic principle of IAM access design?
Q5. Which correctly describes an IAM policy?
Q6. Which correctly contrasts predefined and custom roles?
Keep track of your progress
The full study guide is free to read. Sign up free to practice with the question bank, track what you have read, review your mistakes, and highlight passages.