Interviewers ask, "A user says 'permission denied'. How do you troubleshoot it?" because they want to know: Do you have an ordered troubleshooting method, and do you avoid 'just grant Owner'? This post gives you a ready 30-second answer, the concept in plain English, common mistakes and tips for different roles. It is question 10 of the top 10 GCP resource hierarchy and IAM interview questions.

Short answer (30 seconds): First I get the exact principal, the exact permission and the exact resource from the error. Then I use Policy Troubleshooter. It checks allow, deny and principal access boundary policies and tells me which one blocks the request. If IAM looks correct, I check Organization Policy constraints, VPC Service Controls, and conditions or expired grants. Finally I read the audit logs for the real denied call. I fix it at the right level and never by granting Owner.


GCP interview question 10: Permission Denied - model answer slide

 

What is the interviewer really asking?

Do you have an ordered troubleshooting method, and do you avoid 'just grant Owner'?

Permission Denied in plain English

  • Confirm principal, permission, resource
  • Check allow, deny, PAB with Policy Troubleshooter
  • Then Org Policy, VPC-SC, and audit logs

Easy picture: Like a doctor: collect symptoms (error), run the right test (Policy Troubleshooter), check other body systems (Org Policy, VPC-SC, API), then treat the cause - not just the symptom.

Detailed explanation

  • Step 1: capture the error. It usually names the permission, such as bigquery.tables.getData, and the resource.
  • Step 2: run Policy Troubleshooter with principal + resource + permission. It examines allow, deny and PAB policies and shows which ones apply and how.
  • Step 3: if IAM is fine, look at other layers: Org Policy constraints, VPC Service Controls perimeters (the error will mention a perimeter), IAM Conditions that expired, and API not enabled in the project.
  • Step 4: confirm in Cloud Audit Logs. Then fix with the smallest change at the lowest sensible level, and record why.

Example commands

gcloud policy-troubleshoot iam //cloudresourcemanager.googleapis.com/projects/PROJECT_ID --principal-email=user@example.com --permission=storage.objects.get
gcloud logging read 'protoPayload.status.code=7' --project=PROJECT_ID --limit=20

Replace ORG_ID, FOLDER_ID and PROJECT_ID with your own values. Check gcloud help for current flags before you use a command.

Common mistakes

  • Granting Owner to 'make the error go away'.
  • Checking only the project policy and missing inherited grants or a deny policy.
  • Missing that the API is disabled or a VPC-SC perimeter is blocking the call.

Follow-up questions to expect

  • What if the user has the role but still fails? (Condition, deny policy, PAB, VPC-SC, or wrong resource.)
  • How do you stop repeat tickets? (Document the access model; self-service with expiry.)

How the answer changes by role

Role What to emphasise
Architect Design the access model so failures are easy to explain.
Data Engineer Know the BigQuery job vs data permission split.
DevOps Engineer Pipeline failures: check service account, impersonation, API enablement.
Platform Engineer Provide a self-service troubleshooting guide for product teams.

Senior tip

Tell it as a step-by-step story. Interviewers love a calm, ordered debugging path.

Practice

  1. Say the 30-second answer aloud without reading it, and time yourself.
  2. Draw the diagram from memory on paper.
  3. Explain it once to a junior engineer and once to a CTO.

Watch the video

Prefer to watch? See the full video with all 10 questions: GCP Resource Hierarchy & IAM: Top 10 Senior Interview Questions. There is also a 1-minute Short for this question: watch the Short.

Keep learning

Disclaimer: This blog is independent and not affiliated with or endorsed by Google. Google Cloud features, limits and commands change, so always check the current documentation. Official references: Resource hierarchy, IAM policy types, IAM quotas and limits.