A cloud engineer needs to configure a Compute Engine virtual machine to securely export application logs to Cloud Logging using a dedicated service account and least privilege access. What is the correct sequence of steps to establish this service account authentication flow?
- 1Create a new user-managed service account in the project using `gcloud iam service-accounts create`.
- 2Grant the `roles/logging.logWriter` role to the newly created service account using `gcloud projects add-iam-policy-binding`.
- 3Attach the service account to the Compute Engine instance using `gcloud compute instances set-service-account`.
- 4Execute the application using Google Cloud Client Libraries relying on Application Default Credentials (ADC) to automatically acquire identity tokens.
Answer
The correct operational sequence begins by creating the user-managed service account identity, binding the required least-privilege IAM role (`roles/logging.logWriter`) to that identity at the project level, attaching the service account to the target Compute Engine VM instance, and finally configuring application code to authenticate using Application Default Credentials (ADC).
Establishing a service account workflow follows a strict lifecycle: first, the identity must be created in IAM. Next, access permissions (the predefined `roles/logging.logWriter` role) are bound to the service account. After authorization is configured, the identity is attached to the virtual machine instance so the metadata server can issue tokens. Finally, the application consumes these tokens seamlessly via Application Default Credentials without downloading explicit key files.
Step-by-Step Solution
Key Concept
Creating, granting permissions to, attaching, and consuming user-managed service accounts using Application Default Credentials on Compute Engine.