Examkin

Question

Difficulty: Very hardDeploying and Managing Compute Engine Virtual Machines

A system administrator needs to provision a Compute Engine virtual machine instance using the Google Cloud CLI (`gcloud`). The VM must execute a local multi-line initialization script on startup and perform read-only operations against a Cloud Storage bucket using a custom service account following the principle of least privilege. In what chronological sequence must the administrator perform the steps to configure and launch this virtual machine?

  1. 1Create a dedicated user-managed service account using `gcloud iam service-accounts create`.
  2. 2Grant the `roles/storage.objectViewer` IAM role to the newly created service account for the specific Cloud Storage bucket.
  3. 3Write and save the environment setup commands into a local executable script file (e.g., `init.sh`) on the administrator's local machine.
  4. 4Execute `gcloud compute instances create` including `--service-account`, `--scopes=https://www.googleapis.com/auth/cloud-platform`, and `--metadata-from-file=startup-script=init.sh`.

Answer

The correct operational sequence is: 1) Create the dedicated user-managed service account, 2) Grant the Storage Object Viewer role to the service account, 3) Write and save the initialization shell script locally, and 4) Run `gcloud compute instances create` referencing the service account, `cloud-platform` scope, and `--metadata-from-file=startup-script=init.sh`.
Provisioning a secure Compute Engine instance follows a logical dependency chain: identity creation, permission assignment, local asset preparation, and finally resource instantiation. The service account must exist before IAM roles can be granted to it. The IAM permissions must be bound before the VM boots and attempts to perform storage actions. The startup script file must be saved on the administrator's client machine before `gcloud` can read its contents via `--metadata-from-file`. Finally, launching the instance attaches the service account identity and uploads the local script content into instance metadata.

Step-by-Step Solution

1
Create the custom service account identity.
Establishes a user-managed service account resource in IAM.
Compute Engine instances requiring specific access patterns should use custom service accounts rather than the Default Compute Engine Service Account.
2
Assign the least-privilege IAM role to the service account.
Binds `roles/storage.objectViewer` to the service account identity for the target storage bucket.
IAM permissions must be configured on the service account so that requests made from the instance succeed upon startup.
3
Author the startup script locally.
Creates a local file containing bash setup directives.
When passing local file content to instance metadata via `--metadata-from-file`, the file must already exist on the local file system.
4
Issue the `gcloud compute instances create` command with appropriate flags.
Provisions the Compute Engine VM with attached identity, proper API scopes, and startup script metadata.
Best practice for custom service accounts is to assign the `https://www.googleapis.com/auth/cloud-platform` scope and manage actual access control entirely through IAM roles.

Key Concept

Compute Engine VM Provisioning with Custom Service Accounts and Metadata Startup Scripts
Rate this question

Topics

Deploying and Managing Compute Engine Virtual Machines

More questions from this topic