Question

During a security review, you discover that five developers were granted the basic role 'Editor' at the project level so they could deploy and manage Cloud Run services. Your security team wants you to follow the principle of least privilege while preserving the developers' ability to deploy and manage Cloud Run. What should you do?

Accepted Answer

Grant each developer the predefined 'roles/run.admin' and 'roles/iam.serviceAccountUser' roles, then remove the 'Editor' role binding.

Answer

Grant each developer the basic 'Viewer' role and add them to a Google group that has the 'Editor' role.

Answer

Create a custom role that includes all Cloud Run permissions plus 'resourcemanager.projects.setIamPolicy' and assign it to the developers.

Answer

Leave the 'Editor' role in place but enable Data Access audit logs so all their actions are recorded.