Examkin

Question

Difficulty: EasyCreating and Managing Service Accounts

An engineer needs to set up secure, keyless access for an application running on a Google Compute Engine virtual machine to read data from BigQuery. Arrange the procedural steps in the correct chronological order to achieve this setup following Google Cloud best practices.

  1. 1Create a new user-managed service account using the `gcloud iam service-accounts create` command.
  2. 2Grant the required BigQuery IAM role to the service account using `gcloud projects add-iam-policy-binding`.
  3. 3Provision the Compute Engine VM instance and attach the service account using the `--service-account` flag in `gcloud compute instances create`.
  4. 4Run the application on the VM instance to implicitly authenticate using Application Default Credentials (ADC) without downloading service account keys.

Answer

The correct sequence of steps is: 1) Create the user-managed service account using gcloud, 2) Grant the necessary BigQuery IAM role to the service account identity, 3) Attach the service account to the Compute Engine VM instance upon creation, and 4) Run the application to authenticate keylessly via Application Default Credentials.
The proper sequence requires initializing the service account identity first, granting least-privilege IAM roles to that identity second, attaching the service account identity to the VM instance during creation third, and finally letting the application authenticate keylessly via Application Default Credentials.

Step-by-Step Solution

1
Create the user-managed service account entity in IAM.
A unique service account identity email (SA_NAME@PROJECT_ID.iam.gserviceaccount.com) is established.
An identity must exist in IAM before policy bindings or resource attachments can reference it.
2
Bind the required IAM role (e.g., roles/bigquery.dataViewer) to the service account using `gcloud projects add-iam-policy-binding`.
The service account identity gains authorization to access BigQuery resources.
Granting least-privilege permissions to the service account ensures it has the necessary access once attached.
3
Attach the service account identity to the Compute Engine instance using `gcloud compute instances create` with the `--service-account` flag.
The instance metadata server is configured to issue OAuth 2.0 access tokens on behalf of the service account.
Associating the service account with the VM enables keyless authentication via the metadata server.
4
Execute the application workload using Application Default Credentials (ADC).
The application automatically retrieves tokens from the metadata server and accesses BigQuery securely.
This completes the secure lifecycle without exporting or managing static service account JSON keys.

Key Concept

Creating and Managing Service Accounts
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic