Five IAM Mistakes That Appear on Every Google Cloud Exam

IAM is additive. A role granted at the organisation or folder level applies to everything beneath it, and nothing you configure at the project level subtracts it.

If someone holds Editor at the organisation level, you cannot remove their access to one project by editing that project's policy. You have to change the grant where it was made. Exam questions test this directly, and the plausible-looking wrong answers are always the ones that try to fix it locally.

Least privilege is two decisions, not one: which role, and at which level of the hierarchy. Questions routinely offer the correct role at the wrong scope as a distractor.

Storage Object Viewer is the right role for someone who needs to read objects. Granted at project level, it covers every bucket including ones created next year. Granted on the specific bucket, it does not. Both options will appear.

Owner, Editor and Viewer are legacy roles spanning every service. Editor alone can modify almost everything in a project, including things that would be catastrophic.

The reliable heuristic: if a question describes a specific, narrow need and offers a basic role among the options, the basic role is wrong. Predefined roles are the default correct answer; custom roles are correct only when the question makes clear no predefined role fits.

This is the most consistently tested anti-pattern in the entire programme. A downloaded key is a long-lived credential that works from anywhere, never expires, and is trivially leaked into a repository or a log.

• For a workload running on the platform — attach a service account to the resource.
• For a workload in Kubernetes — use Workload Identity.
• For a workload outside the platform — use workload identity federation.
• For a human who needs elevated access — use impersonation, which is temporary and audited.

These solve different problems and are evaluated separately. IAM answers 'is this identity allowed to do this?'. Organisation policy answers 'is this action permitted here at all, regardless of who is asking?'.

When a question says something must never be possible, even for a project owner, IAM cannot deliver it — a project owner can grant themselves whatever permission they need. Organisation policy can, because it constrains the action itself.

IAM rewards practice more than reading. Create a service account with a single narrow role, attach it to something, then try an action it lacks permission for and read the error. Grant a role at project level and observe what it reaches. Add a condition with a short expiry and watch access stop.

An hour spent doing this is worth several hours of reading about role definitions, because the exam tests recognition rather than recall.