Configure Access and Security
What this domain really tests
Identity and access: IAM roles and bindings, service accounts, keys, and network security. Questions probe least privilege, service account best practices, and how policies combine.
Concepts to master
- Roles: primitive (Owner/Editor/Viewer), predefined, and custom. Bindings grant roles to members (users, groups, service accounts).
- Service accounts: identities for workloads; prefer attached service accounts over exported keys. Use workload identity federation for external workloads.
- Deny policies and org policies: deny overrides allow; org policies constrain resource configuration.
- Network security: firewall rules, VPC Service Controls, and private connectivity.
- Audit logs: Admin Activity (always on) vs Data Access (opt-in).
Traps
- Granting a primitive role (Editor) when a predefined role suffices - a least-privilege violation.
- Downloading service account keys instead of using attached service accounts or federation.
- Assuming Data Access logs are on by default - they are not; Admin Activity logs are.
- Forgetting that deny policies take precedence over allow bindings.
Rule of thumb
Grant to groups, not individuals; use predefined roles; avoid long-lived keys. If a question mentions "external workload," think workload identity federation.
Worked example
An app on GKE needs to read a Cloud Storage bucket. Attach a service account with roles/storage.objectViewer to the workload rather than exporting a key.