Examkin

Question

Difficulty: HardCreating and Managing Service Accounts

A cloud security engineer is tasking a DevOps team with deploying an automated monitoring agent on a new Google Compute Engine VM instance. The deployment must strictly adhere to Google Cloud security best practices of least privilege and secure service account management. Arrange the following administrative gcloud CLI and IAM setup steps in the correct operational sequence required to create, configure, delegate access for, and attach the custom service account.

  1. 1Create a dedicated custom service account using `gcloud iam service-accounts create ops-monitor-sa --display-name="Ops Monitor SA"`.
  2. 2Grant the required metric writing predefined role to the service account at the project level using `gcloud projects add-iam-policy-binding PROJECT_ID --member="serviceAccount:ops-monitor-sa@PROJECT_ID.iam.gserviceaccount.com" --role="roles/monitoring.metricWriter"`.
  3. 3Grant the `roles/iam.serviceAccountUser` role on the service account resource to the DevOps engineer's identity using `gcloud iam service-accounts add-iam-policy-binding ops-monitor-sa@PROJECT_ID.iam.gserviceaccount.com --member="user:[email protected]" --role="roles/iam.serviceAccountUser"`.
  4. 4Deploy the Compute Engine instance attaching the customized service account using `gcloud compute instances create monitor-vm --zone=us-central1-a --service-account=ops-monitor-sa@PROJECT_ID.iam.gserviceaccount.com --scopes=https://www.googleapis.com/auth/monitoring.write`.

Answer

The correct sequence is: First, create the custom service account using `gcloud iam service-accounts create`. Second, assign the predefined role (`roles/monitoring.metricWriter`) to the service account at the project level using `gcloud projects add-iam-policy-binding`. Third, grant the provisioning user the `roles/iam.serviceAccountUser` role directly on the service account via `gcloud iam service-accounts add-iam-policy-binding`. Fourth, create the Compute Engine VM instance specifying `--service-account` with the service account email via `gcloud compute instances create`.
Provisioning a secure Compute Engine workload requires establishing the service account identity first (`gcloud iam service-accounts create`). Next, granting least-privilege predefined permissions to the service account (`gcloud projects add-iam-policy-binding`) establishes what the workload can do. Then, authorizing the deploying user to use the service account (`roles/iam.serviceAccountUser` via `gcloud iam service-accounts add-iam-policy-binding`) allows resource attachment. Finally, initiating VM creation with `--service-account` attaches the identity to the instance.

Step-by-Step Solution

1
Create the Service Account identity
A non-human service account identity `ops-monitor-sa@PROJECT_ID.iam.gserviceaccount.com` is provisioned.
IAM roles cannot be assigned to an identity that does not yet exist in Google Cloud IAM.
2
Assign predefined IAM role to the Service Account
The service account gains authorization to write monitoring metrics to Google Cloud Monitoring.
Granting least-privilege predefined roles directly to the workload service account ensures strict access control before deployment.
3
Grant Service Account User permission to the deploying entity
The DevOps engineer receives authorization to attach the service account to compute resources.
Compute Engine instance creation requires the user executing the command to have `iam.serviceAccounts.actAs` permission, provided by `roles/iam.serviceAccountUser` on the targeted service account.
4
Attach the Service Account during instance creation
The VM instance is created with the dedicated service account attached, avoiding static service account key exports.
Attaching the service account allows applications running on the instance to access Google Cloud APIs securely through the internal metadata server.

Key Concept

Creating and attaching custom service accounts to Compute Engine instances following least-privilege IAM configuration and ServiceAccountUser role delegation.
Estimated Time:2m 0s
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic