API / APIGEE Gateway Interview Questions
What is RBAC (Role-Based Access Control) in Apigee and what are the built-in roles?
Apigee integrates with Google Cloud IAM for access control. Every Apigee operation is controlled by IAM roles assigned to users or service accounts at the Google Cloud project or organisation level.
| Role | Permissions | Typical user |
|---|---|---|
| roles/apigee.admin | Full control: create, update, delete all Apigee resources | Platform administrator |
| roles/apigee.apiCreator | Create and manage API proxies, shared flows, API products | API developer |
| roles/apigee.deployer | Deploy and undeploy proxies to environments | CI/CD service account |
| roles/apigee.analyticsViewer | View analytics data only | Business analyst, product manager |
| roles/apigee.environmentAdmin | Manage environments, target servers, KVMs, caches | Environment admin |
| roles/apigee.readOnlyAdmin | View all resources but cannot create or modify | Auditor, read-only reviewer |
# Grant a service account the deployer role (for CI/CD): gcloud projects add-iam-policy-binding my-project \ --member="serviceAccount:cicd-sa@my-project.iam.gserviceaccount.com" \ --role="roles/apigee.deployer" # Grant a developer the API creator role: gcloud projects add-iam-policy-binding my-project \ --member="user:dev@example.com" \ --role="roles/apigee.apiCreator" # Principle of least privilege: # CI/CD pipelines should use roles/apigee.deployer only # (deploy but not delete or modify proxy logic) # Application developers: roles/apigee.apiCreator # Business analysts: roles/apigee.analyticsViewer # Service account authentication for CI/CD: gcloud auth activate-service-account \ --key-file=cicd-sa-key.json TOKEN=$(gcloud auth print-access-token) apigeecli apis deploy --token $TOKEN ...
Which IAM role should a CI/CD service account be granted to deploy proxy revisions without the ability to delete or modify proxy configurations?
What is the principle of least privilege as applied to Apigee IAM roles?
More Related questions...
