What's changed: Created Professional Cloud Architect Chapter 5 (Domain 3 "Security and compliance": IAM/least privilege/governance = avoid basic roles/predefined-custom/groups, service accounts/Workload Identity Federation, organization policies/guardrails; data protection and compliance = GMEK/CMEK/CSEK/Cloud KMS/Cloud EKM, Sensitive Data Protection/Cloud DLP, data residency, Assured Workloads/Cloud Audit Logs/VPC Service Controls).
5.1IAM, least privilege, and organizational governance
Understand designing least privilege with IAM (avoid basic roles; predefined/custom roles), service accounts and Workload Identity Federation, enforcing constraints with organization policies, and designing permission inheritance and guardrails along the resource hierarchy.
Security starts with governing "who can access what." The architect designs least privilege and consistent guardrails with IAM and organization policies.
5.1.1IAM and least privilege
IAM defines who (member) gets which role (permissions) on which resource. Avoid overly broad basic roles (Owner/Editor/Viewer); grant fitting predefined roles or least-privilege custom roles. Granting via groups eases management. Use service accounts for apps/workloads, and for external identities avoid distributing keys by federating securely with Workload Identity Federation. Map "least privilege for people and apps" and "avoid key distribution = Workload Identity Federation."
Continue reading — free sign-up
You're reading the free preview. Sign up free to read this section in full, plus every chapter (including 4+) and all questions.