IAM Roles

Question 1

roles

Answer 1

define the can do what on which resource part of Cloud IAM.
is a named list of permissions defined by IAM

Question 2

There are three types of roles in Cloud IAM

Answer 2

There are three types of roles in Cloud IAM, basic roles, predefined roles, and custom roles.

Question 3

basic roles

Answer 3

Basic roles are the original roles that were available in the Cloud console, but they are broad.
You apply them to a Google Crowd project, and they affect all resources in that project.
The basic roles are the owner, editor and viewer roles and billing administrator role

Question 4

basic roles who can do what

Answer 4

The owner has full administrative access.This includes the ability to add and remove members and delete projects.
The editor role has modify and delete access.This allows the developer to deploy applications and modify or configure its resources.
The view role has read only access.
billing administrator role manage billing and add or remove administrators without the right to change the resources in the project.

Question 5

basic roles are concentric except billing rolle

Answer 5

That is the owner role includes the permissions of the editor role.
And the editor role includes the permissions of the viewer role.

Question 6

predefined roles

Answer 6

Define where the roles can be applied. Provide members with granular access to specific GCP resources and prevent unwanted access to other resources.
These roles are a collection of permissions, because to do any meaningful operations, you usually need more than one permission.

Question 7

example GSP service role
instance admin role on a project

Answer 7

provides the users of that group:
compute.instances.delete
compute.instances.get
compute.instances.list
compute.instances.setMachineType
compute.instances.start
compute.instances.stop
….

Question 8

permissions themselves are classes and methods in the API’s

Answer 8

The permissions themselves are classes and methods in the API’s
For example:
compute.instances.start
can be broken down into the service, resource and verb.
That mean that the permission is used to start a stopped Compute Engine instance.

Question 9

Which permissions Network Admin role has

Answer 9

permissions to create, modify and delete network resources, except for firewall rules and SSL certificates. (read only access to firewall rules SSL certificates, and instances to view their ephemeral IP addresses.)

Question 10

The storage admin role contains

Answer 10

permissions to create, modify, and delete disks, images, and snapshots.

Question 11

which roles allow you to define least privileged permission model

Answer 11

custom roles, they are even even finer grained