Your continuous integration and delivery (CI/CD) server can't execute Google Cloud actions in a specific project because of permission issues. You need to validate whether the used service account has the appropriate roles in the specific project. What should you do?

The most direct and fundamental method to validate a service account's permissions is to inspect its Identity and Access Management (IAM) role bindings. The Google Cloud console's IAM page for the specific project displays all principals, including the service account in question, and the roles assigned to them. Crucially, this view also shows roles that are inherited from parent resources in the hierarchy, such as folders and the organization. This comprehensive view allows you to confirm if the service account has the necessary roles to perform its tasks, directly addressing the core of the permission issue.

A. This describes using the Policy Analyzer. While it can determine effective permissions, the primary and most direct step to validate assigned roles is to view the IAM policy itself.
B. Audit logs confirm that permission errors have occurred, but they don't show the current role configuration. They are for post-event analysis, not for validating the current state of permissions.
C. Organization policies apply constraints on resource configurations (e.g., restricting locations), but they do not grant permissions. The issue described is a lack of permissions, which is managed by IAM roles. ---

1. Google Cloud Documentation

IAM - View access to a project

folder

or organization: "You can get a list of all IAM principals... who have IAM roles for a project... The list includes principals who have been granted roles on the project directly

and principals who have inherited roles from a folder or organization." This directly supports option D as the standard procedure for checking roles and inheritance.

2. Google Cloud Documentation

IAM - Policy inheritance: "When you grant a role to a user at a level in the resource hierarchy

they inherit the permissions from that role for all resources under that level... For example

if you grant a user the Project Editor role at the organization level

they can edit any project in the organization." This explains the inheritance concept mentioned in option D.

3. Google Cloud Documentation

Policy Intelligence - Policy Analyzer overview: "Policy Analyzer lets you find out what principals have access to which Google Cloud resources." This describes the functionality in option A

which is a powerful but secondary tool to directly viewing the IAM policy for role validation.

4. Google Cloud Documentation

Cloud Audit Logs - Overview: "Cloud Audit Logs maintains the following audit logs for each project

folder

and organization: Admin Activity audit logs

Data Access audit logs

System Event audit logs

and Policy Denied audit logs." This confirms that logs are for recording events

which is the focus of option B.