Question

A data governance team needs a group of auditors to list all Cloud Storage buckets in a project and view each bucket's IAM policy and configuration metadata, but they must NOT be able to read the objects stored inside any bucket. The security engineer wants to grant the narrowest possible access. Which approach best satisfies least privilege?

Accepted Answer

Create a custom role containing only storage.buckets.list, storage.buckets.get, and storage.buckets.getIamPolicy permissions, and grant it to the auditors group at the project level.

Answer

Grant the auditors group the predefined roles/storage.objectViewer role at the project level.

Answer

Grant the auditors group the predefined roles/storage.admin role at the project level.

Answer

Grant the auditors group roles/viewer at the project level so they can inspect all resources read-only.