Examkin

Question

Difficulty: MediumDeploying and Managing Compute Engine Virtual Machines

A cloud engineer needs to update an existing running Compute Engine virtual machine instance named `app-worker-1` to use a custom IAM service account named `[email protected]` instead of the default Compute Engine service account. The configuration update must be completed using the Google Cloud CLI (`gcloud`) without deleting the instance or losing disk state. Which sequence of actions should the cloud engineer execute?

  1. Stop instance `app-worker-1`, run `gcloud compute instances set-service-account app-worker-1 [email protected] --scopes=cloud-platform`, and start instance `app-worker-1`.Answer
  2. B
    Run `gcloud compute instances update app-worker-1 [email protected]` directly while the instance is running.
  3. C
    Run `gcloud compute instances add-metadata app-worker-1 --metadata=service-account=app-sa@prod-proj.iam.gserviceaccount.com` while the instance is running.
  4. D
    Stop instance `app-worker-1`, run `gcloud compute instances set-scopes app-worker-1 --roles=roles/editor`, and start instance `app-worker-1`.

Answer

Stop instance `app-worker-1`, run `gcloud compute instances set-service-account app-worker-1 [email protected] --scopes=cloud-platform`, and start instance `app-worker-1`.
To modify the IAM service account attached to an existing Compute Engine VM instance, the instance must first be stopped. Once stopped, running `gcloud compute instances set-service-account` with the `--service-account` flag successfully updates the attached service account. Restarting the instance completes the deployment without losing persistent data.

Step-by-Step Solution

1
Identify the requirement for modifying a Compute Engine VM's service account.
Recognize that updating an instance's service account identity cannot be performed while the VM is in the RUNNING state.
Compute Engine enforces that instances must be stopped before changing attached service accounts or access scopes.
2
Select the correct `gcloud compute instances` command sub-group.
Use `gcloud compute instances set-service-account` with the `--service-account` flag specifying the target service account email address.
The `set-service-account` command updates the VM's identity configuration without requiring instance re-creation.
3
Assemble the operational order of commands.
Stop the instance, execute the `set-service-account` command, and then start the instance.
This workflow safely updates the VM configuration while preserving all attached persistent disks and data.

Key Concept

Modifying Compute Engine VM Service Account Identity
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic