Question

A new financial auditor joins your company and needs to review the configuration and metadata of all resources across a single GCP project without being able to modify anything or read the actual data stored in Cloud Storage buckets or BigQuery tables. Following the principle of least privilege, how should you grant this access?

Accepted Answer

Grant the predefined roles/viewer (Project Viewer) role to the auditor at the project level

Answer

Grant the basic roles/editor role to the auditor at the project level

Answer

Grant the roles/owner role scoped to the organization node

Answer

Create a service account, download a key, and share it with the auditor