A financial institution is implementing a new application on Google Cloud that processes sensitive customer data. Due to strict regulatory requirements, they need to ensure that no single individual has 'break glass' access to the production environment without multiple approvals. Specifically, they want to prevent any single project owner from unilaterally granting themselves or others highly privileged roles on production resources. How can the security engineer enforce this multi-approval mechanism for elevated privileges in Google Cloud?
- ARemove all project owners and replace them with a single custom service account for all deployments.
- BUtilize Identity Platform for multi-factor authentication on all administrative accounts.
- CImplement custom IAM roles with conditional role bindings using 'request.auth.claims' for approval.
- DConfigure Access Approval for specific resource types and roles in the production environment.
Show answer & explanationAnswer & explanation
Correct answer: D. Configure Access Approval for specific resource types and roles in the production environment.
Access Approval is designed for scenarios where manual approval is required for Google personnel (or, in some advanced cases, for internal break-glass scenarios with custom integrations) to access customer data or configurations. However, the question is about preventing *project owners* from unilaterally granting *themselves or others* highly privileged roles. While the wording can be tricky, the core capability of requiring multi-party approval for sensitive actions or access is best addressed by a combination of strong IAM policies (least privilege, custom roles) and, for break-glass, potentially leveraging Access Approval or custom solutions built around Cloud IAM Conditions for approval workflows. Given the options, Access Approval is the closest fit for 'multi-approval mechanism for elevated privileges' in a regulatory context, assuming it can be adapted or integrated for internal use cases beyond just Google personnel access. A more precise feature for internal multi-approval would be a custom workflow triggering Cloud IAM Conditions on 'request.auth.claims', but among the given options, Access Approval is the most directly related to 'approval' for access.
Why the other options are wrong
- A. Removing project owners and replacing them with a single service account centralizes risk and violates the principle of least privilege and separation of duties. This is a severe security anti-pattern.
- B. Identity Platform is for customer-facing identity management and provides MFA for users, but it doesn't enforce multi-approval for granting IAM roles or accessing sensitive resources.
- C. Custom IAM roles with conditional role bindings can *restrict* access based on conditions, but they don't inherently provide a *multi-approval workflow* for granting roles or access. They can be part of a solution, but not the primary enforcement mechanism for multi-approval.
Google Cloud Access Approval
A Google Cloud service that allows customers to explicitly approve or deny requests for Google support and engineering personnel to access customer data or configurations in the cloud.
- Provides an audit trail of access requests and approvals.
- Enables 'justification required' and 'approval required' policies.
- Primarily for Google's access, but principle aligns with multi-approval concepts.
Memory trick: Access Approval is the 'traffic light' for 'two' 'thumbs up'.