Question

A retail company is migrating its resource hierarchy. The security team wants to grant the marketing team's analysts a way to manage their own IAM bindings on BigQuery datasets within a single project, but the team must NOT be able to grant themselves or others any roles that are more privileged than the ones already present in the project. Analysts should also be prevented from acting on any resource outside that project. Which approach best enforces this requirement while following least privilege?

Accepted Answer

Grant the analysts a custom role at the project level containing only bigquery.datasets.* and the specific dataset IAM setPolicy/getPolicy permissions, and add an IAM Condition restricting bindings to the marketing datasets.

Answer

Grant the analysts the roles/resourcemanager.projectIamAdmin role at the project level so they can manage all IAM bindings for that project.

Answer

Grant the analysts roles/owner on the project so they have full control over the datasets and their permissions.

Answer

Grant the analysts roles/iam.securityAdmin at the organization level and rely on an organization policy to block cross-project access.