Question

A security engineer at a retail company reviews an IAM issue. A developer, dev@example.com, unexpectedly has the ability to view logs in the project 'prod-payments'. The engineer confirms the project-level IAM policy for 'prod-payments' does NOT grant dev@example.com any role. However, the developer can still read logs. Which of the following is the MOST likely explanation and where the engineer should look next?

Accepted Answer

IAM policies are inherited down the resource hierarchy; dev@example.com was likely granted the Logs Viewer or a broader role at the organization or a parent folder level, and that binding is additive to the project policy.

Answer

Project-level IAM policies always override parent bindings, so the engineer should re-check the project policy because inherited roles cannot grant access when the project policy is empty.

Answer

The developer must have a service account key for the project; the engineer should rotate the key to remove the log-reading access.

Answer

An organization policy constraint is granting the log access, so the engineer should modify the org policy to deny logging for the developer.