Question

A security engineer at a financial services company is performing a quarterly access review. A data analyst was granted the roles/editor role on the analytics project six months ago, but audit logs show they have only ever read BigQuery datasets and viewed Cloud Storage objects. Leadership wants to enforce least privilege while avoiding disruption to the analyst's legitimate work. Which approach should the engineer use to most efficiently right-size this access based on actual usage?

Accepted Answer

Use IAM Recommender role recommendations, which analyze the last 90 days of usage to suggest replacing the broad role with less-permissive roles that cover observed activity.

Answer

Immediately remove the analyst's IAM binding entirely and wait for them to file access requests for any permissions they discover they need.

Answer

Create a custom role that includes every permission contained in roles/editor and assign it so the analyst retains identical access.

Answer

Apply an IAM deny policy that blocks write operations while leaving the roles/editor grant in place so no permissions need to be re-evaluated.