Question

Your company has an organization with a folder named 'production' that contains 15 projects. The security team wants a new group, gcp-prod-auditors@example.com, to have read-only visibility across all resources in every current and future project under the 'production' folder. You want to minimize administrative effort while following the principle of least privilege. What should you do?

Accepted Answer

Grant the group the roles/viewer role on the 'production' folder.

Answer

Grant the group the roles/viewer role on each of the 15 projects individually.

Answer

Grant the group the roles/editor role on the organization.

Answer

Grant the group the roles/viewer role on the organization.