Examkin

Question

Difficulty: HardDeploying and Managing Compute Engine Virtual Machines

A cloud engineer needs to deploy a Compute Engine virtual machine instance that automatically executes a bash initialization script stored in a private Cloud Storage bucket upon booting. The VM must adhere to the principle of least privilege using a custom service account. Arrange the required administrative steps in the correct chronological sequence from first to last.

  1. 1Create a custom IAM service account specifically for the virtual machine workload.
  2. 2Grant the Storage Object Viewer role (roles/storage.objectViewer) to the custom service account on the bucket hosting the script.
  3. 3Upload the bash initialization script to the designated Cloud Storage bucket path.
  4. 4Run gcloud compute instances create specifying --service-account, --scopes=https://www.googleapis.com/auth/cloud-platform, and --metadata=startup-script-url.
  5. 5Execute gcloud compute instances get-serial-port-output to review console output and verify successful script execution.

Answer

The correct sequence of steps is: 1) Create the custom service account, 2) Grant the service account Storage Object Viewer permissions on the script bucket, 3) Upload the initialization script to Cloud Storage, 4) Deploy the VM with gcloud using the service account and startup-script-url metadata flags, and 5) Verify script execution logs via the serial port output.
The correct procedural order ensures identity creation and resource authorization occur before instance provisioning. First, creating the custom service account establishes a dedicated identity. Second, assigning the Storage Object Viewer IAM role on the bucket grants the necessary read permission. Third, staging the script file in Cloud Storage ensures the asset exists. Fourth, invoking gcloud compute instances create attaches the service account with --scopes=cloud-platform and supplies the --metadata=startup-script-url flag. Finally, retrieving serial port output validates that the startup script completed without error.

Step-by-Step Solution

1
Define workload identity
Custom service account created without default editor privileges.
Following the principle of least privilege requires establishing a specific non-default service account identity first.
2
Configure IAM access control
Service account authorized with Storage Object Viewer on the target bucket.
The startup script fetching mechanism runs under the instance service account identity during boot, requiring read access to Cloud Storage.
3
Stage application artifacts
Initialization script file uploaded to the GCS bucket path.
The file resource must exist at the specified gs:// URI prior to triggering the instance provisioning workflow.
4
Provision the Compute Engine VM
Instance created with custom service account identity and metadata key pointing to GCS URI.
Passing startup-script-url via metadata tells the Compute Engine startup agent to fetch and run the script automatically on boot.
5
Validate deployment
Serial console log stream inspected for successful script execution.
Serial port output records startup script stdout/stderr, providing positive empirical proof of successful initialization.

Key Concept

Deploying Compute Engine VMs with Custom Service Accounts and Cloud Storage Startup Scripts
Estimated Time:2m 0s
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic