Google Cloud's core recommendation for Identity and Access Management (IAM) scalability is to manage access using Google Groups rather than individual users.
* Manageability: Instead of updating IAM policies in three different projects every time a developer joins or leaves the company, you simply add/remove them from a single Google Group (e.g., [email protected]).
* Enforcement: You apply the Editor role to the group in the Dev Project, the Viewer role in the Staging Project, and no roles in the Production Project. This centrally manages the "Joiner-Mover- Leaver" process.
* Correcting other options:
* A: Firewalls control network traffic, not identity-based access to GCP resources like BigQuery or Dataflow.
* C: Granting roles to individuals is prone to error, difficult to audit, and does not scale.
* D: VPC Service Controls are for mitigating data exfiltration, not for basic user-level role management across environments.
Reference: Google Cloud IAM Best Practices:
"Grant roles to groups instead of individual users. It is easier to update the members of a group than to update the principals in your allow policies... Using groups helps you manage permissions at scale and simplifies auditing." (Source: Best practices for using Google Groups)
"For a consistent security posture, use groups to represent job functions and assign roles to those groups at the appropriate level in the resource hierarchy." (Source: IAM guide - Manage access to projects, folders, and organizations)