Question

Your SOC is deploying a Google SecOps SOAR playbook that automatically quarantines Compute Engine instances flagged by high-severity Cloud IDS detections. The playbook must call the Compute Engine API to apply firewall tags but should never be able to delete instances or modify IAM policies. During review, the security architect insists the automation follow least-privilege principles while remaining functional for the quarantine action. How should you configure the integration's credentials?

Accepted Answer

Assign the playbook's service account a custom IAM role granting only compute.instances.setTags and related networking permissions, scoped to the target project

Answer

Grant the playbook's service account the roles/compute.admin predefined role so it can reliably perform any needed remediation action

Answer

Use the SecOps platform's default service account with roles/editor to avoid maintaining a separate credential

Answer

Authenticate the playbook using an individual analyst's user credentials so actions are attributed to the on-call responder