Allow an operations worker to view logs but prevent network deletion and billing-setting changes.
Which design is appropriate?
Assign a least-privilege role that permits only the operations required for the job.
Detailed explanation
Correct. A role limited to required operations reduces accidental and compromised-account impact.
Correct. A role limited to required operations reduces accidental and compromised-account impact.
Incorrect. Giving everyone administrator access violates least privilege.
Incorrect. Giving everyone administrator access violates least privilege.
Incorrect. Shortening passwords weakens authentication and does not separate permissions.
Incorrect. Shortening passwords weakens authentication and does not separate permissions.
Incorrect. Disabling audit logs removes accountability.
Incorrect. Disabling audit logs removes accountability.
Try it yourself
An example you can run in a temporary verification environment.
printf '%s\n' 'read-only operations must not grant destructive permissions'Expected result
read-only operations must not grant destructive permissionsKey points
- Least privilege
- Role
- Operation separation
Notes
- Environment: クラウドIAM設計の概念確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.