To grant a group read-only access to all resources, including detection engine rules, which configuration is correct?

• A. Create a Google Group and add the required users. Grant the roles/chronicle.viewer IAM role to the group on the project associated with your Google SecOps instance
• B. Create a Google Group and add the required users. Grant the roles/chronicle.limitedViewer IAM role to the group on the project associated with your Google SecOps instance
• C. Create a workforce identity pool at the organization level. Grant the roles/chronicle.editor IAM role to the principal set on the project associated with your Google SecOps instance
• D. Create a workforce identity pool at the organization level. Grant the roles/chronicle.limitedViewer IAM role to the principal set on the project associated with your Google SecOps instance

Answer: (A)

Granting read-only access to all Chronicle resources, including detection engine rules, is accomplished by using an IAM read-only role applied to a group, so that every member inherits those permissions. The best approach is to create a Google Group for the users, add them to the group, and grant the Chronicle viewer role to that group on the relevant project. This role provides full read-only access across Chronicle resources, including detection engine rules, and applying it to the group makes user management scalable—add or remove people from the group and their access is updated automatically.

Other approaches fall short for this requirement. A more restricted read-only role may omit some Chronicle resources or rules, leaving gaps in visibility. Using a workforce identity pool at the organization level introduces unnecessary complexity and federation concerns, and choosing an editor or other higher-privilege role would grant write access, which is not desired for a read-only scenario.