Examkin

Question

Difficulty: MediumCreating and Managing Service Accounts

An engineer needs to configure a custom service account for an application running on a Google Compute Engine VM instance in project `prod-data-pipeline`. The application requires permission to write objects to Cloud Storage buckets within the project. What is the correct sequence of steps to configure least-privilege access and attach the service account to the VM instance?

  1. 1Create the custom service account `app-writer` using `gcloud iam service-accounts create app-writer --display-name="App Storage Writer"`.
  2. 2Grant the Storage Object Admin role to the service account using `gcloud projects add-iam-policy-binding prod-data-pipeline --member="serviceAccount:[email protected]" --role="roles/storage.objectAdmin"`.
  3. 3Provision the Compute Engine VM instance with the service account attached using `gcloud compute instances create app-vm --service-account="[email protected]" --scopes="cloud-platform"`.
  4. 4Execute application code inside the VM instance to automatically retrieve short-lived credentials from the metadata server using Application Default Credentials (ADC).

Answer

The correct sequence of steps is: First, create the custom service account (`app-writer`). Second, grant the required IAM role (`roles/storage.objectAdmin`) to the service account email. Third, provision the Compute Engine VM instance with the service account attached and `cloud-platform` scope. Fourth, run application code on the VM to authenticate via Application Default Credentials (ADC).
The correct deployment order follows the GCP resource dependency lifecycle: First, create the service account resource to generate its unique email identifier. Second, grant the required predefined IAM role to the service account identity at the project level. Third, create the Compute Engine VM instance, attaching the custom service account with the `cloud-platform` scope so that IAM controls access. Fourth, launch the workload application which retrieves short-lived access tokens from the instance metadata server via Application Default Credentials.

Step-by-Step Solution

1
Create the service account identity in the target project.
Service account email `[email protected]` is generated.
An IAM identity must exist before IAM policy bindings or compute resource attachments can reference it.
2
Bind the required predefined IAM role to the service account identity.
The service account gains `roles/storage.objectAdmin` permissions on project `prod-data-pipeline`.
Permissions must be bound to the identity before compute workloads rely on it to perform storage operations.
3
Attach the service account during Compute Engine VM creation.
The Compute Engine VM `app-vm` is configured with the custom service account identity.
Attaching the service account at instance creation ensures the instance metadata server provides credentials for this identity.
4
Run application code leveraging metadata server ADC.
The application seamlessly authenticates without long-lived service account keys.
Application Default Credentials automatically query `http://metadata.google.internal` for short-lived access tokens.

Key Concept

Provisioning and attaching custom service accounts to Compute Engine instances using gcloud CLI and least-privilege IAM bindings.
Rate this question

Topics

Creating and Managing Service Accounts

More questions from this topic