Question

A financial services company must grant its internal audit team the ability to read configuration and metadata across all projects in an organization to verify controls, but auditors must never be able to modify resources or read customer data. The security team wants to avoid over-provisioning that comes with broad predefined roles. Which approach best follows least-privilege while satisfying the auditors' need for org-wide read visibility?

Accepted Answer

Grant the auditors the Security Reviewer (roles/iam.securityReviewer) role plus a custom role containing only the specific metadata and configuration read permissions they need, bound at the organization level.

Answer

Grant the auditors the predefined Viewer (roles/viewer) role at the organization level so they inherit read access to every project.

Answer

Grant the auditors the Organization Administrator role but attach an IAM deny policy blocking write operations.

Answer

Create a shared service account with Editor at the org level and have all auditors download and use its key for read operations.