Question

Your SOC is deploying a Google SecOps SOAR playbook that automatically quarantines Compute Engine instances flagged by Security Command Center findings. The playbook uses a dedicated service account to call the Compute Engine API to apply deny-all firewall tags. During an architecture review, the security lead insists the integration follow least privilege while still being able to remediate across all production projects. Which access configuration best satisfies both the functional and least-privilege requirements?

Accepted Answer

Grant the playbook service account roles/compute.securityAdmin bound to a folder containing only the production projects, and enable IAM Conditions to restrict actions to firewall tag operations

Answer

Grant the playbook service account the roles/compute.securityAdmin role at the organization level so it can act on any current or future project

Answer

Grant the playbook service account roles/owner on each production project so remediation never fails due to missing permissions

Answer

Use the default Compute Engine service account for the playbook and add roles/editor at the organization level